[Chromoting] Add wildcard to talkgadget in manifest permissions.

[Chromoting] Add wildcard to talkgadget in manifest permissions.

This grants permission to <anything>.talkgadget.google.com as well as allowing
simply talkgadget.google.com.

This is to prepare for (1) changing the default talkgadget name to something
specific to chromoting and (2) adding a policy setting that allows the
talkgadget name to be changed.

BUG=108448
TEST=none

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=149105

[Jamie, 2012-07-17 23:52:20]

http://codereview.chromium.org/10789054/diff/1/remoting/webapp/manifest.json
File remoting/webapp/manifest.json (right):

http://codereview.chromium.org/10789054/diff/1/remoting/webapp/manifest.json#...
remoting/webapp/manifest.json:27:
"https://*.talkgadget.google.com/talkgadget/*",
Don't you still need the original permission until the Javascript is changed?

[Wez, 2012-07-17 23:53:14]

http://codereview.chromium.org/10789054/diff/1/remoting/webapp/manifest.json
File remoting/webapp/manifest.json (right):

http://codereview.chromium.org/10789054/diff/1/remoting/webapp/manifest.json#...
remoting/webapp/manifest.json:27:
"https://*.talkgadget.google.com/talkgadget/*",
What stops the app then accessing e.g.
https://myevildomain.com/talkgadget.google.com/talkgadget/?

http://codereview.chromium.org/10789054/diff/1/remoting/webapp/manifest.json#...
remoting/webapp/manifest.json:27:
"https://*.talkgadget.google.com/talkgadget/*",
On 2012/07/17 23:52:20, Jamie wrote:
> Don't you still need the original permission until the Javascript is changed?

Yes; with this change the app will be able to access foo.talkgadget.google.com
but not talkgadget.google.com...

[garykac, 2012-07-18 00:03:30]

Surprising as this may seem, I did actually test it out and it works just fine
with talkgadget.google.com.  (I also explicitly mention this in the
description.)

As for matching, evildomain.com/..., the match pattern docs
(http://code.google.com/chrome/extensions/match_patterns.html) indicate that
shouldn't happen since the wildcard will only apply to the hostpart.

[garykac, 2012-07-30 18:41:13]

Ping!

We considered explicitly listing all of the allowable xxx.talkgadget values, but
we want to add a policy setting that allows this to be policy-admin settable. So
we prefer using the "wildcard".

We reviewed this with some security folks and they signed off.  Note that it's
not a real wildcard, but just a convenient notation to allow:
   talkgadget.google.com
   <anything>.talkgadget.google.com

For reference, the code for the URL matching is URLPattern::Parse in
src/chrome/common/extensions/url_pattern.cc

[garykac, 2012-07-30 18:47:06]

+jamiewalch

[garykac, 2012-07-30 23:10:22]

ptal

[Jamie, 2012-07-30 23:17:33]

http://codereview.chromium.org/10789054/diff/14001/remoting/webapp/build-weba...
File remoting/webapp/build-webapp.py (right):

http://codereview.chromium.org/10789054/diff/14001/remoting/webapp/build-weba...
remoting/webapp/build-webapp.py:170: 'https://chromoting.talkgadget.google.com/'
This is just the OAuth redirect URL. If we change it, we need to update the API
Console support this URL, and we can't revoke the old one until all users are
updated to the new web-app. Since we need to change the wcs URL anyway, do we
need to change this one?

[garykac, 2012-07-31 00:38:50]

On 2012/07/30 23:17:33, Jamie wrote:
>
http://codereview.chromium.org/10789054/diff/14001/remoting/webapp/build-weba...
> File remoting/webapp/build-webapp.py (right):
> 
>
http://codereview.chromium.org/10789054/diff/14001/remoting/webapp/build-weba...
> remoting/webapp/build-webapp.py:170:
'https://chromoting.talkgadget.google.com/'
> This is just the OAuth redirect URL. If we change it, we need to update the
API
> Console support this URL, and we can't revoke the old one until all users are
> updated to the new web-app. Since we need to change the wcs URL anyway, do we
> need to change this one?

I think it's best if all of our Talk access is done via chromoting.talkgadget
since admins can simply block that without wondering if they need to block
talkgadget as well to catch Chromoting's OAuth traffic.

[Jamie, 2012-07-31 01:15:44]

lgtm