Add an experimental permissions API for extensions.

chrome/browser/extensions/extension_prefs.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_prefs.h"
 
 #include "base/string_number_conversions.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/extensions/extension_pref_store.h"
@@ skipping 84 matching lines @@
 
 // A preference for storing extra data sent in update checks for an extension.
 const char kUpdateUrlData[] = "update_url_data";
 
 // Whether the browser action is visible in the toolbar.
 const char kBrowserActionVisible[] = "browser_action_visible";
 
 // Preferences that hold which permissions the user has granted the extension.
 // We explicitly keep track of these so that extensions can contain unknown
 // permissions, for backwards compatibility reasons, and we can still prompt
-// the user to accept them once recognized.
-const char kPrefGrantedAPIs[] = "granted_permissions.api";
-const char kPrefGrantedExplicitHosts[] = "granted_permissions.explicit_host";
-const char kPrefGrantedScriptableHosts[] =
-    "granted_permissions.scriptable_host";
+// the user to accept them once recognized. We store the active permission
+// permissions because they may differ from those defined in the manifest.
+const char kPrefActivePermissions[] = "active_permissions";
+const char kPrefGrantedPermissions[] = "granted_permissions";
+
+// The preference names for ExtensionPermissionSet values.
+const char kPrefAPIs[] = "api";
+const char kPrefExplicitHosts[] = "explicit_host";
+const char kPrefScriptableHosts[] = "scriptable_host";
 
 // The preference names for the old granted permissions scheme.
 const char kPrefOldGrantedFullAccess[] = "granted_permissions.full";
 const char kPrefOldGrantedHosts[] = "granted_permissions.host";
 const char kPrefOldGrantedAPIs[] = "granted_permissions.api";
 
 // A preference that indicates when an extension was installed.
 const char kPrefInstallTime[] = "install_time";
 
 // A preference that indicates whether the extension was installed from the
@@ skipping 79 matching lines @@
   }
 
  private:
   PrefService* prefs_;
   const std::string extension_id_;
   const std::string incognito_or_regular_path_;
 
   DISALLOW_COPY_AND_ASSIGN(ScopedExtensionControlledPrefUpdate);
 };
 
+std::string JoinPrefs(std::string parent, const char* child) {
+  return parent + "." + child;
+}
+
 }  // namespace
 
 ExtensionPrefs::ExtensionPrefs(
     PrefService* prefs,
     const FilePath& root_dir,
     ExtensionPrefValueMap* extension_pref_value_map)
     : prefs_(prefs),
       install_directory_(root_dir),
       extension_pref_value_map_(extension_pref_value_map),
       content_settings_store_(new ExtensionContentSettingsStore()) {
@@ skipping 197 matching lines @@
     const std::string& pref_key,
     const URLPatternSet& new_value) {
   ListValue* value = new ListValue();
   for (URLPatternSet::const_iterator i = new_value.begin();
        i != new_value.end(); ++i)
     value->AppendIfNotPresent(Value::CreateStringValue(i->GetAsString()));
 
   UpdateExtensionPref(extension_id, pref_key, value);
 }
 
+ExtensionPermissionSet* ExtensionPrefs::ReadExtensionPrefPermissionSet(
+    const std::string& extension_id,
+    const std::string& pref_key) {
+  if (!GetExtensionPref(extension_id))
+    return NULL;
+
+  // Retrieve the API permissions.
+  ExtensionAPIPermissionSet apis;
+  const ListValue* api_values = NULL;
+  std::string api_pref = JoinPrefs(pref_key, kPrefAPIs);
+  if (ReadExtensionPrefList(extension_id, api_pref, &api_values)) {
+    ExtensionPermissionsInfo* info = ExtensionPermissionsInfo::GetInstance();
+    for (size_t i = 0; i < api_values->GetSize(); ++i) {
+      std::string permission_name;
+      if (api_values->GetString(i, &permission_name)) {
+        ExtensionAPIPermission *permission = info->GetByName(permission_name);
+        if (permission)
+          apis.insert(permission->id());
+      }
+    }
+  }
+
+  // Retrieve the explicit host permissions.
+  URLPatternSet explicit_hosts;
+  ReadExtensionPrefURLPatternSet(
+      extension_id, JoinPrefs(pref_key, kPrefExplicitHosts),
+      &explicit_hosts, Extension::kValidHostPermissionSchemes);
+
+  // Retrieve the scriptable host permissions.
+  URLPatternSet scriptable_hosts;
+  ReadExtensionPrefURLPatternSet(
+      extension_id, JoinPrefs(pref_key, kPrefScriptableHosts),
+      &scriptable_hosts, UserScript::kValidUserScriptSchemes);
+
+  return new ExtensionPermissionSet(apis, explicit_hosts, scriptable_hosts);
+}
+
+void ExtensionPrefs::SetExtensionPrefPermissionSet(
+    const std::string& extension_id,
+    const std::string& pref_key,
+    const ExtensionPermissionSet* new_value) {
+  // Set the API permissions.
+  ListValue* api_values = new ListValue();
+  ExtensionAPIPermissionSet apis = new_value->apis();
+  ExtensionPermissionsInfo* info = ExtensionPermissionsInfo::GetInstance();
+  std::string api_pref = JoinPrefs(pref_key, kPrefAPIs);
+  for (ExtensionAPIPermissionSet::const_iterator i = apis.begin();
+       i != apis.end(); ++i) {
+    ExtensionAPIPermission* perm = info->GetByID(*i);
+    if (perm)
+      api_values->Append(Value::CreateStringValue(perm->name()));
+  }
+  UpdateExtensionPref(extension_id, api_pref, api_values);
+
+  // Set the explicit host permissions.
+  if (!new_value->explicit_hosts().is_empty()) {
+    SetExtensionPrefURLPatternSet(extension_id,
+                                  JoinPrefs(pref_key, kPrefExplicitHosts),
+                                  new_value->explicit_hosts());
+  }
+
+  // Set the scriptable host permissions.
+  if (!new_value->scriptable_hosts().is_empty()) {
+    SetExtensionPrefURLPatternSet(extension_id,
+                                  JoinPrefs(pref_key, kPrefScriptableHosts),
+                                  new_value->scriptable_hosts());
+  }
+}
+
 void ExtensionPrefs::SavePrefs() {
   prefs_->ScheduleSavePersistentPrefs();
 }
 
 // static
 bool ExtensionPrefs::IsBlacklistBitSet(DictionaryValue* ext) {
   return ReadBooleanFromPref(ext, kPrefBlacklist);
 }
 
 bool ExtensionPrefs::IsExtensionBlacklisted(const std::string& extension_id) {
@@ skipping 195 matching lines @@
 
     // Remove the full access bit (empty list will get trimmed).
     UpdateExtensionPref(
         *ext_id, kPrefOldGrantedFullAccess, new ListValue());
 
     // Add the plugin permission if the full access bit was set.
     if (full_access) {
       ListValue* apis = NULL;
       ListValue* new_apis = NULL;
 
-      if (ext->GetList(kPrefGrantedAPIs, &apis))
+      std::string granted_apis =
+          JoinPrefs(kPrefGrantedPermissions, kPrefAPIs);
+      if (ext->GetList(kPrefOldGrantedAPIs, &apis))
         new_apis = apis->DeepCopy();
       else
         new_apis = new ListValue();
 
       std::string plugin_name = info->GetByID(
           ExtensionAPIPermission::kPlugin)->name();
       new_apis->Append(Value::CreateStringValue(plugin_name));
-      UpdateExtensionPref(*ext_id, kPrefGrantedAPIs, new_apis);
+      UpdateExtensionPref(*ext_id, granted_apis, new_apis);
     }
 
     // The granted permissions originally only held the effective hosts,
     // which are a combination of host and user script host permissions.
     // We now maintain these lists separately. For migration purposes, it
     // does not matter how we treat the old effective hosts as long as the
     // new effective hosts will be the same, so we move them to explicit
     // host permissions.
     ListValue* hosts;
+    std::string explicit_hosts =
+        JoinPrefs(kPrefGrantedPermissions, kPrefExplicitHosts);
     if (ext->GetList(kPrefOldGrantedHosts, &hosts)) {
       UpdateExtensionPref(
-          *ext_id, kPrefGrantedExplicitHosts, hosts->DeepCopy());
+          *ext_id, explicit_hosts, hosts->DeepCopy());
 
       // We can get rid of the old one by setting it to an empty list.
       UpdateExtensionPref(*ext_id, kPrefOldGrantedHosts, new ListValue());
     }
   }
 }
 
 ExtensionPermissionSet* ExtensionPrefs::GetGrantedPermissions(
     const std::string& extension_id) {
   CHECK(Extension::IdIsValid(extension_id));
-
-  const DictionaryValue* ext = GetExtensionPref(extension_id);
-  if (!ext)
-    return NULL;
-
-  // Retrieve the API permissions.
-  ExtensionAPIPermissionSet apis;
-  const ListValue* api_values = NULL;
-  if (ReadExtensionPrefList(extension_id, kPrefGrantedAPIs, &api_values)) {
-    ExtensionPermissionsInfo* info = ExtensionPermissionsInfo::GetInstance();
-    for (size_t i = 0; i < api_values->GetSize(); ++i) {
-      std::string permission_name;
-      if (api_values->GetString(i, &permission_name)) {
-        ExtensionAPIPermission *permission = info->GetByName(permission_name);
-        if (permission)
-          apis.insert(permission->id());
-      }
-    }
-  }
-
-  // Retrieve the explicit host permissions.
-  URLPatternSet explicit_hosts;
-  ReadExtensionPrefURLPatternSet(
-      extension_id, kPrefGrantedExplicitHosts,
-      &explicit_hosts, Extension::kValidHostPermissionSchemes);
-
-  // Retrieve the scriptable host permissions.
-  URLPatternSet scriptable_hosts;
-  ReadExtensionPrefURLPatternSet(
-      extension_id, kPrefGrantedScriptableHosts,
-      &scriptable_hosts, UserScript::kValidUserScriptSchemes);
-
-  return new ExtensionPermissionSet(apis, explicit_hosts, scriptable_hosts);
+  return ReadExtensionPrefPermissionSet(extension_id, kPrefGrantedPermissions);
 }
 
 void ExtensionPrefs::AddGrantedPermissions(
     const std::string& extension_id,
     const ExtensionPermissionSet* permissions) {
   CHECK(Extension::IdIsValid(extension_id));
 
-  scoped_ptr<ExtensionPermissionSet> granted_permissions(
+  scoped_refptr<ExtensionPermissionSet> granted_permissions(
       GetGrantedPermissions(extension_id));
 
   // The new granted permissions are the union of the already granted
   // permissions and the newly granted permissions.
-  scoped_ptr<ExtensionPermissionSet> new_perms(
+  scoped_refptr<ExtensionPermissionSet> new_perms(
       ExtensionPermissionSet::CreateUnion(
           permissions, granted_permissions.get()));
 
-  // Set the API permissions.
-  ListValue* api_values = new ListValue();
-  ExtensionAPIPermissionSet apis = new_perms->apis();
-  ExtensionPermissionsInfo* info = ExtensionPermissionsInfo::GetInstance();
-  for (ExtensionAPIPermissionSet::const_iterator i = apis.begin();
-       i != apis.end(); ++i) {
-    ExtensionAPIPermission* perm = info->GetByID(*i);
-    if (perm)
-      api_values->Append(Value::CreateStringValue(perm->name()));
-  }
-  UpdateExtensionPref(extension_id, kPrefGrantedAPIs, api_values);
+  SetExtensionPrefPermissionSet(
+      extension_id, kPrefGrantedPermissions, new_perms.get());
+}
 
-  // Set the explicit host permissions.
-  if (!new_perms->explicit_hosts().is_empty()) {
-    SetExtensionPrefURLPatternSet(extension_id,
-                                  kPrefGrantedExplicitHosts,
-                                  new_perms->explicit_hosts());
-  }
+ExtensionPermissionSet* ExtensionPrefs::GetActivePermissions(
+    const std::string& extension_id) {
+  CHECK(Extension::IdIsValid(extension_id));
+  return ReadExtensionPrefPermissionSet(extension_id, kPrefActivePermissions);
+}
 
-  // Set the scriptable host permissions.
-  if (!new_perms->scriptable_hosts().is_empty()) {
-    SetExtensionPrefURLPatternSet(extension_id,
-                                  kPrefGrantedScriptableHosts,
-                                  new_perms->scriptable_hosts());
-  }
+void ExtensionPrefs::SetActivePermissions(
+    const std::string& extension_id,
+    const ExtensionPermissionSet* permissions) {
+  SetExtensionPrefPermissionSet(
+      extension_id, kPrefActivePermissions, permissions);
 }
 
 bool ExtensionPrefs::IsIncognitoEnabled(const std::string& extension_id) {
   return ReadExtensionPrefBoolean(extension_id, kPrefIncognitoEnabled);
 }
 
 void ExtensionPrefs::SetIsIncognitoEnabled(const std::string& extension_id,
                                            bool enabled) {
   UpdateExtensionPref(extension_id, kPrefIncognitoEnabled,
                       Value::CreateBooleanValue(enabled));
@@ skipping 869 matching lines @@
   prefs->RegisterListPref(prefs::kExtensionInstallAllowList,
                           PrefService::UNSYNCABLE_PREF);
   prefs->RegisterListPref(prefs::kExtensionInstallDenyList,
                           PrefService::UNSYNCABLE_PREF);
   prefs->RegisterListPref(prefs::kExtensionInstallForceList,
                           PrefService::UNSYNCABLE_PREF);
   prefs->RegisterStringPref(kWebStoreLogin,
                             std::string() /* default_value */,
                             PrefService::UNSYNCABLE_PREF);
 }