Track permissions granted to extensions in prefs

chrome/common/extensions/extension_unittest.cc

Index: chrome/common/extensions/extension_unittest.cc
diff --git a/chrome/common/extensions/extension_unittest.cc b/chrome/common/extensions/extension_unittest.cc
index 3f86bbd3f75bde0a16f719225a33305ec8d96cb3..bb3f4621ec46bf1ab2cfe64f99a8883d2399cd6a 100644
--- a/chrome/common/extensions/extension_unittest.cc
+++ b/chrome/common/extensions/extension_unittest.cc
@@ -48,6 +48,11 @@ void CompareLists(const std::vector<std::string>& expected,
   }
 }
 
+static void AddPattern(ExtensionExtent* extent, const std::string& pattern) {
+  int schemes = URLPattern::SCHEME_ALL;
+  extent->AddPattern(URLPattern(schemes, pattern));
+}
+
 }
 
 class ExtensionTest : public testing::Test {
@@ -252,9 +257,10 @@ TEST(ExtensionTest, InitFromValueInvalid) {
   EXPECT_FALSE(extension.InitFromValue(*input_value, true, &error));
   EXPECT_TRUE(MatchPattern(error, errors::kInvalidPermission));
 
+  // We allow unknown API permissions, so this will be valid until we better
+  // distinguish between API and host permissions.
   permissions->Set(0, Value::CreateStringValue("www.google.com"));
-  EXPECT_FALSE(extension.InitFromValue(*input_value, true, &error));
-  EXPECT_TRUE(MatchPattern(error, errors::kInvalidPermission));
+  EXPECT_TRUE(extension.InitFromValue(*input_value, true, &error));
 
   // Multiple page actions are not allowed.
   input_value.reset(static_cast<DictionaryValue*>(valid_value->DeepCopy()));
@@ -327,10 +333,11 @@ TEST(ExtensionTest, InitFromValueValid) {
   ListValue* permissions = new ListValue;
   permissions->Set(0, Value::CreateStringValue("file:///C:/foo.txt"));
   input_value.Set(keys::kPermissions, permissions);
-  EXPECT_FALSE(extension.InitFromValue(input_value, false, &error));
-  EXPECT_TRUE(MatchPattern(error, errors::kInvalidPermission));
+
+  // We allow unknown API permissions, so this will be valid until we better
+  // distinguish between API and host permissions.
+  EXPECT_TRUE(extension.InitFromValue(input_value, false, &error));
   input_value.Remove(keys::kPermissions, NULL);
-  error.clear();
 
   // Test with an options page.
   input_value.SetString(keys::kOptionsPage, "options.html");
@@ -816,29 +823,61 @@ TEST(ExtensionTest, EffectiveHostPermissions) {
 TEST(ExtensionTest, IsPrivilegeIncrease) {
   const struct {
     const char* base_name;
+    const char** granted_apis;
+    const char** granted_hosts;
     bool expect_success;
   } kTests[] = {
-    { "allhosts1", false },  // all -> all
-    { "allhosts2", false },  // all -> one
-    { "allhosts3", true },  // one -> all
-    { "hosts1", false },  // http://a,http://b -> http://a,http://b
-    { "hosts2", false },  // http://a,http://b -> https://a,http://*.b
-    { "hosts3", false },  // http://a,http://b -> http://a
-    { "hosts4", true },  // http://a -> http://a,http://b
-    { "hosts5", false },  // http://a,b,c -> http://a,b,c + https://a,b,c
-    { "hosts6", false },  // http://a.com -> http://a.com + http://a.co.uk
-    { "permissions1", false },  // tabs -> tabs
-    { "permissions2", true },  // tabs -> tabs,bookmarks
-    { "permissions3", true },  // http://a -> http://a,tabs
-    { "permissions5", true },  // bookmarks -> bookmarks,history
+    { "allhosts1", (const char*[]){NULL},
+      (const char*[]){"http://*/", NULL},
+      false },  // all -> all
+    { "allhosts2", (const char*[]){NULL},
+      (const char*[]){"http://*/", NULL},
+      false },  // all -> one
+    { "allhosts3", (const char*[]){NULL},
+      (const char*[]){NULL}, true },  // one -> all
+    { "hosts1", (const char*[]){NULL},
+      (const char*[]){"http://www.google.com/", "http://www.reddit.com/", NULL},
+      false },  // http://a,http://b -> http://a,http://b
+    { "hosts2", (const char*[]){NULL},
+      (const char*[]){"http://www.google.com/", "http://www.reddit.com/", NULL},
+      false },  // http://a,http://b -> https://a,http://*.b
+    { "hosts3", (const char*[]){NULL},
+      (const char*[]){"http://www.google.com/", "http://www.reddit.com/", NULL},
+      false },  // http://a,http://b -> http://a
+    { "hosts4", (const char*[]){NULL},
+      (const char*[]){"http://www.google.com/", NULL},
+      true },  // http://a -> http://a,http://b
+    { "hosts5", (const char*[]){"tabs", "notifications", NULL},
+      (const char*[]){"http://*.example.com/", "http://*.example.com/*",
+                      "http://*.example.co.uk/*", "http://*.example.com.au/*",
+                      NULL},
+      false },  // http://a,b,c -> http://a,b,c + https://a,b,c
+    { "hosts6", (const char*[]){"tabs", "notifications", NULL},
+      (const char*[]){"http://*.example.com/", "http://*.example.com/*", NULL},
+      false },  // http://a.com -> http://a.com + http://a.co.uk
+    { "permissions1", (const char*[]){"tabs", NULL},
+      (const char*[]){NULL}, false },  // tabs -> tabs
+    { "permissions2", (const char*[]){"tabs", NULL},
+      (const char*[]){NULL}, true },  // tabs -> tabs,bookmarks
+    { "permissions3", (const char*[]){NULL},
+      (const char*[]){"http://*/*", NULL},
+      true },  // http://a -> http://a,tabs
+    { "permissions5", (const char*[]){"bookmarks", NULL},
+      (const char*[]){NULL}, true },  // bookmarks -> bookmarks,history
 #if !defined(OS_CHROMEOS)  // plugins aren't allowed in ChromeOS
-    { "permissions4", false },  // plugin -> plugin,tabs
-    { "plugin1", false },  // plugin -> plugin
-    { "plugin2", false },  // plugin -> none
-    { "plugin3", true },  // none -> plugin
+    { "permissions4", (const char*[]){NULL},
+      (const char*[]){NULL}, false },  // plugin -> plugin,tabs
+    { "plugin1", (const char*[]){NULL},
+      (const char*[]){NULL}, false },  // plugin -> plugin
+    { "plugin2", (const char*[]){NULL},
+      (const char*[]){NULL}, false },  // plugin -> none
+    { "plugin3", (const char*[]){NULL},
+      (const char*[]){NULL}, true },  // none -> plugin
 #endif
-    { "storage", false },  // none -> storage
-    { "notifications", false }  // none -> notifications
+    { "storage", (const char*[]){NULL},
+      (const char*[]){NULL}, false },  // none -> storage
+    { "notifications", (const char*[]){NULL},
+      (const char*[]){NULL}, false }  // none -> notifications
   };
 
   for (size_t i = 0; i < ARRAYSIZE_UNSAFE(kTests); ++i) {
@@ -849,13 +888,22 @@ TEST(ExtensionTest, IsPrivilegeIncrease) {
         LoadManifest("allow_silent_upgrade",
                      std::string(kTests[i].base_name) + "_new.json"));
 
+    std::set<std::string> granted_apis;
+    for (size_t j = 0; kTests[i].granted_apis[j] != NULL; ++j)
+      granted_apis.insert(kTests[i].granted_apis[j]);
+
+    ExtensionExtent granted_hosts;
+    for (size_t j = 0; kTests[i].granted_hosts[j] != NULL; ++j)
+      AddPattern(&granted_hosts, kTests[i].granted_hosts[j]);
+
     EXPECT_TRUE(old_extension.get()) << kTests[i].base_name << "_old.json";
     EXPECT_TRUE(new_extension.get()) << kTests[i].base_name << "_new.json";
     if (!old_extension.get() || !new_extension.get())
       continue;
 
     EXPECT_EQ(kTests[i].expect_success,
-              Extension::IsPrivilegeIncrease(old_extension.get(),
+              Extension::IsPrivilegeIncrease(granted_apis, granted_hosts,
+                                             old_extension.get(),
                                              new_extension.get()))
         << kTests[i].base_name;
   }