Force update checks to use SSL for store-hosted extensions/apps.

Force update checks to use SSL for store-hosted extensions/apps.

BUG=129587
TEST=Autoupdate and blacklist of extensions/apps from WebStore should
still work. Also existing unit/browser tests should pass.


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=138961

[Aaron Boodman, 2012-05-24 23:17:41]

http://codereview.chromium.org/10446027/diff/3001/chrome/browser/extensions/u...
File chrome/browser/extensions/updater/extension_downloader.cc (right):

http://codereview.chromium.org/10446027/diff/3001/chrome/browser/extensions/u...
chrome/browser/extensions/updater/extension_downloader.cc:459: if
(!crx_url.SchemeIsSecure()) {
Will this affect non-store updates?

[asargent_no_longer_on_chrome, 2012-05-24 23:23:52]

http://codereview.chromium.org/10446027/diff/3001/chrome/browser/extensions/u...
File chrome/browser/extensions/updater/extension_downloader.cc (right):

http://codereview.chromium.org/10446027/diff/3001/chrome/browser/extensions/u...
chrome/browser/extensions/updater/extension_downloader.cc:459: if
(!crx_url.SchemeIsSecure()) {
On 2012/05/24 23:17:41, Aaron Boodman wrote:
> Will this affect non-store updates?
No, this is in the else block for the "if (id != kBlacklistAppID) {" check
above. This is handling the results for the blacklist contents - we already
forced the update check for that to be SSL, but this is just ensuring that even
if the server said to use plain http to fetch the blacklist contents, we
override that. A patch is going into the server to make sure they always send a
response with an SSL url for the blacklist. So this is just defense in depth.
(Note that we already ensure that the blacklist contents match a hash the server
told us about in the response to the SSL update check)

[asargent_no_longer_on_chrome, 2012-05-24 23:26:31]

On 2012/05/24 23:23:52, Antony Sargent wrote:
>
http://codereview.chromium.org/10446027/diff/3001/chrome/browser/extensions/u...
> File chrome/browser/extensions/updater/extension_downloader.cc (right):
> 
>
http://codereview.chromium.org/10446027/diff/3001/chrome/browser/extensions/u...
> chrome/browser/extensions/updater/extension_downloader.cc:459: if
> (!crx_url.SchemeIsSecure()) {
> On 2012/05/24 23:17:41, Aaron Boodman wrote:
> > Will this affect non-store updates?
> No, this is in the else block for the "if (id != kBlacklistAppID) {" check
> above. This is handling the results for the blacklist contents - we already
> forced the update check for that to be SSL, but this is just ensuring that
even
> if the server said to use plain http to fetch the blacklist contents, we
> override that. A patch is going into the server to make sure they always send
a
> response with an SSL url for the blacklist. So this is just defense in depth.
> (Note that we already ensure that the blacklist contents match a hash the
server
> told us about in the response to the SSL update check)

Sorry, when I said "This is handling the results for the blacklist contents" I
actually meant "This is handling the results for the manifest we got back when
doing the blacklist update check"

[Aaron Boodman, 2012-05-25 00:12:59]

lgtm

[commit-bot: I haz the power, 2012-05-25 00:14:43]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/asargent@chromium.org/10446027/3001

[commit-bot: I haz the power, 2012-05-25 01:37:00]

Change committed as 138961