Only allow installation of extensions/apps with gallery update url via download from gallery

chrome/common/extensions/extension.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/extension.h"
 
 #include <algorithm>
 
 #include "app/l10n_util.h"
 #include "app/resource_bundle.h"
@@ skipping 1470 matching lines @@
   // Although |source| is passed in as a const, it's still possible to modify
   // it.  This is dangerous since the utility process re-uses |source| after
   // it calls InitFromValue, passing it up to the browser process which calls
   // InitFromValue again.  As a result, we need to make sure that nobody
   // accidentally modifies it.
   DCHECK(source.Equals(manifest_value_.get()));
 
   return true;
 }
 
+// static
+std::string Extension::ChromeStoreURL() {
+  std::string gallery_prefix = extension_urls::kGalleryBrowsePrefix;
+  if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kAppsGalleryURL))
+    gallery_prefix = CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
+        switches::kAppsGalleryURL);
+  return gallery_prefix;
+}
+
 GURL Extension::GalleryUrl() const {
   if (!update_url_.DomainIs("google.com"))
     return GURL();
 
-  GURL url(std::string(extension_urls::kGalleryBrowsePrefix) +
-           std::string("/detail/") + id_);
+  GURL url(ChromeStoreURL() + std::string("/detail/") + id_);
 
   return url;
 }
 
 std::set<FilePath> Extension::GetBrowserImages() {
   std::set<FilePath> image_paths;
 
   // Extension icons.
   for (std::map<int, std::string>::iterator iter = icons_.begin();
        iter != icons_.end(); ++iter) {
@@ skipping 131 matching lines @@
     if (host->MatchesUrl(url))
       return true;
   }
   return false;
 }
 
 bool Extension::CanExecuteScriptOnHost(const GURL& url,
                                        std::string* error) const {
   // No extensions are allowed to execute script on the gallery because that
   // would allow extensions to manipulate their own install pages.
-  if (url.host() == GURL(extension_urls::kGalleryBrowsePrefix).host()) {
+  if (url.host() == GURL(ChromeStoreURL()).host()) {
     if (error)
       *error = errors::kCannotScriptGallery;
     return false;
   }
 
   if (HasHostPermission(url))
       return true;
 
   if (error) {
     *error = ExtensionErrorUtils::FormatErrorMessage(errors::kCannotAccessPage,
@@ skipping 55 matching lines @@
         } else {
           return false;
         }
       } else {
         return true;
       }
     }
   }
   return false;
 }