Merge 32770 - Revert change that disallowed content scripts access to...

chrome/browser/extensions/extension_install_ui.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_install_ui.h"
 
 #include <map>
 
 #include "app/l10n_util.h"
 #include "app/resource_bundle.h"
 #include "base/file_util.h"
 #include "base/rand_util.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/browser_list.h"
 #include "chrome/browser/browser_window.h"
 #include "chrome/browser/extensions/theme_installed_infobar_delegate.h"
 #include "chrome/browser/profile.h"
 #include "chrome/browser/tab_contents/tab_contents.h"
 #if defined(TOOLKIT_VIEWS)  // TODO(port)
 #include "chrome/browser/views/extensions/extension_installed_bubble.h"
 #endif  // TOOLKIT_VIEWS
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/notification_service.h"
+#include "chrome/common/url_constants.h"
 #include "grit/browser_resources.h"
 #include "grit/chromium_strings.h"
 #include "grit/generated_resources.h"
 #include "grit/theme_resources.h"
 
 #if defined(TOOLKIT_GTK)
 #include "chrome/browser/extensions/gtk_theme_installed_infobar_delegate.h"
 #include "chrome/browser/gtk/gtk_theme_provider.h"
 #endif
 
 namespace {
 
 static std::wstring GetInstallWarning(Extension* extension) {
   // If the extension has a plugin, it's easy: the plugin has the most severe
   // warning.
   if (!extension->plugins().empty())
     return l10n_util::GetString(IDS_EXTENSION_PROMPT_WARNING_NEW_FULL_ACCESS);
 
+  // We also show the severe warning if the extension has access to any file://
+  // URLs. They aren't *quite* as dangerous as full access to the system via
+  // NPAPI, but pretty dang close. Content scripts are currently the only way
+  // that extension can get access to file:// URLs.
+  for (UserScriptList::const_iterator script =
+           extension->content_scripts().begin();
+       script != extension->content_scripts().end();
+       ++script) {
+    for (UserScript::PatternList::const_iterator pattern =
+             script->url_patterns().begin();
+         pattern != script->url_patterns().end();
+         ++pattern) {
+      if (pattern->scheme() == chrome::kFileScheme) {
+        return l10n_util::GetString(
+            IDS_EXTENSION_PROMPT_WARNING_NEW_FULL_ACCESS);
+      }
+    }
+  }
+
   // Otherwise, we go in descending order of severity: all hosts, several hosts,
   // a single host, no hosts. For each of these, we also have a variation of the
   // message for when api permissions are also requested.
   if (extension->HasAccessToAllHosts()) {
     if (extension->api_permissions().empty())
       return l10n_util::GetString(IDS_EXTENSION_PROMPT_WARNING_NEW_ALL_HOSTS);
     else
       return l10n_util::GetString(
           IDS_EXTENSION_PROMPT_WARNING_NEW_ALL_HOSTS_AND_BROWSER);
   }
@@ skipping 171 matching lines @@
 InfoBarDelegate* ExtensionInstallUI::GetNewInfoBarDelegate(
     Extension* new_theme, TabContents* tab_contents) {
 #if defined(TOOLKIT_GTK)
   return new GtkThemeInstalledInfoBarDelegate(tab_contents, new_theme,
       previous_theme_id_, previous_use_gtk_theme_);
 #else
   return new ThemeInstalledInfoBarDelegate(tab_contents, new_theme,
       previous_theme_id_);
 #endif
 }