Make downloads.download() respect host permissions

chrome/browser/download/download_extension_api.cc

Index: chrome/browser/download/download_extension_api.cc
diff --git a/chrome/browser/download/download_extension_api.cc b/chrome/browser/download/download_extension_api.cc
index 70db7d6132b9b20dbf44685efa71014649a1b57d..c603f3a3876b199696070da1946280fee82802bd 100644
--- a/chrome/browser/download/download_extension_api.cc
+++ b/chrome/browser/download/download_extension_api.cc
@@ -380,6 +380,13 @@ bool DownloadsDownloadFunction::ParseArgs() {
     return false;
   }
 
+  if (!iodata_->url.SchemeIs("data") &&
+      iodata_->url.GetOrigin() != GetExtension()->url().GetOrigin() &&
+      !GetExtension()->HasHostPermission(iodata_->url)) {
+    error_ = download_extension_errors::kInvalidURLError;
+    return false;
+  }
+
   if (options->HasKey(kFilenameKey)) {
     EXTENSION_FUNCTION_VALIDATE(options->GetString(
         kFilenameKey, &iodata_->filename));