Reland restrict extension features based on the extension type.

chrome/common/extensions/extension.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/extension.h"
 
 #include <algorithm>
 
 #include "base/base64.h"
 #include "base/basictypes.h"
@@ skipping 15 matching lines @@
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/chrome_version_info.h"
 #include "chrome/common/extensions/extension_action.h"
 #include "chrome/common/extensions/extension_constants.h"
 #include "chrome/common/extensions/extension_error_utils.h"
 #include "chrome/common/extensions/extension_l10n_util.h"
 #include "chrome/common/extensions/extension_resource.h"
 #include "chrome/common/extensions/extension_sidebar_defaults.h"
 #include "chrome/common/extensions/extension_sidebar_utils.h"
 #include "chrome/common/extensions/file_browser_handler.h"
+#include "chrome/common/extensions/manifest_value.h"
 #include "chrome/common/extensions/user_script.h"
 #include "chrome/common/url_constants.h"
 #include "googleurl/src/url_util.h"
 #include "grit/chromium_strings.h"
 #include "grit/generated_resources.h"
 #include "grit/theme_resources.h"
 #include "net/base/registry_controlled_domain.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
@@ skipping 27 matching lines @@
 static void ConvertHexadecimalToIDAlphabet(std::string* id) {
   for (size_t i = 0; i < id->size(); ++i) {
     int val;
     if (base::HexStringToInt(id->begin() + i, id->begin() + i + 1, &val))
       (*id)[i] = val + 'a';
     else
       (*id)[i] = 'a';
   }
 }
 
-// These keys are allowed by all crx files (apps, extensions, themes, etc).
-static const char* kBaseCrxKeys[] = {
-  keys::kCurrentLocale,
-  keys::kDefaultLocale,
-  keys::kDescription,
-  keys::kIcons,
-  keys::kName,
-  keys::kPublicKey,
-  keys::kSignature,
-  keys::kVersion,
-  keys::kUpdateURL
-};
-
-bool IsBaseCrxKey(const std::string& key) {
-  for (size_t i = 0; i < arraysize(kBaseCrxKeys); ++i) {
-    if (key == kBaseCrxKeys[i])
-      return true;
-  }
-
-  return false;
-}
-
 // A singleton object containing global data needed by the extension objects.
 class ExtensionConfig {
  public:
   static ExtensionConfig* GetInstance() {
     return Singleton<ExtensionConfig>::get();
   }
 
   Extension::ScriptingWhitelist* whitelist() { return &scripting_whitelist_; }
 
  private:
@@ skipping 125 matching lines @@
 
 // static
 scoped_refptr<Extension> Extension::Create(const FilePath& path,
                                            Location location,
                                            const DictionaryValue& value,
                                            int flags,
                                            std::string* error) {
   DCHECK(error);
   scoped_refptr<Extension> extension = new Extension(path, location);
 
-  if (!extension->InitFromValue(value, flags, error))
+  if (!extension->InitFromValue(ManifestValue(value.DeepCopy()), flags, error))

[Aaron Boodman, 2011/11/23 01:45:25]

This kinda sucks, we end up copying this same DictionaryValue several times.
(once here, once into ManifestValue's member, and then we copy the ManifestValue
into Extension).

If either InitFromValue() or ManifestValue() took pointers to their param
instead of const-ref, then they could just take ownership of them instead of
copying.

[jstritar, 2011/11/28 23:09:56]

Done, we only copy the DictionaryValue once now.

     return NULL;
   return extension;
 }
 
 scoped_refptr<Extension> Extension::CreateWithId(const FilePath& path,
                                                  Location location,
                                                  const DictionaryValue& value,
                                                  int flags,
                                                  const std::string& explicit_id,
                                                  std::string* error) {
@@ skipping 624 matching lines @@
     GURL url = extension_sidebar_utils::ResolveRelativePath(
         default_page, this, error);
     if (!url.is_valid())
       return NULL;
     result->set_default_page(url);
   }
 
   return result.release();
 }
 
-bool Extension::ContainsNonThemeKeys(const DictionaryValue& source) const {
-  for (DictionaryValue::key_iterator key = source.begin_keys();
-       key != source.end_keys(); ++key) {
-    if (!IsBaseCrxKey(*key) && *key != keys::kTheme)
-      return true;
-  }
-  return false;
-}
-
-bool Extension::LoadIsApp(const DictionaryValue* manifest,
+bool Extension::LoadIsApp(const ManifestValue* manifest,
                           std::string* error) {
-  if (manifest->HasKey(keys::kApp))
-    is_app_ = true;
+  is_app_ = manifest->HasKey(keys::kApp);

[Aaron Boodman, 2011/11/23 01:45:25]

Can you get rid of all the is_*_ members in Extension and change all the is_*()
methods to delegate to the new class, so that we have a single source of truth?

[jstritar, 2011/11/28 23:09:56]

Done.

 
   if (CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kEnablePlatformApps)) {
-    if (manifest->HasKey(keys::kPlatformApp))
-      is_platform_app_ = true;
-  }
+          switches::kEnablePlatformApps))
+    is_platform_app_ = manifest->HasKey(keys::kPlatformApp);
 
   return true;
 }
 
-bool Extension::LoadExtent(const DictionaryValue* manifest,
+bool Extension::LoadExtent(const ManifestValue* manifest,
                            const char* key,
                            URLPatternSet* extent,
                            const char* list_error,
                            const char* value_error,
                            URLPattern::ParseOption parse_strictness,
                            std::string* error) {
   Value* temp = NULL;
   if (!manifest->Get(key, &temp))
     return true;
 
@@ skipping 56 matching lines @@
       return false;
     }
     pattern.SetPath(pattern.path() + '*');
 
     extent->AddPattern(pattern);
   }
 
   return true;
 }
 
-bool Extension::LoadLaunchURL(const DictionaryValue* manifest,
+bool Extension::LoadLaunchURL(const ManifestValue* manifest,
                               std::string* error) {
   Value* temp = NULL;
 
   // launch URL can be either local (to chrome-extension:// root) or an absolute
   // web URL.
   if (manifest->Get(keys::kLaunchLocalPath, &temp)) {
     if (manifest->Get(keys::kLaunchWebURL, NULL)) {
       *error = errors::kLaunchPathAndURLAreExclusive;
       return false;
     }
@@ skipping 77 matching lines @@
       GURL::Replacements replacements;
       replacements.SetPathStr(path);
       GURL cloud_print_enable_connector_url =
           cloud_print_service_url.ReplaceComponents(replacements);
       OverrideLaunchUrl(cloud_print_enable_connector_url);
     }
   }
   return true;
 }
 
-bool Extension::LoadLaunchContainer(const DictionaryValue* manifest,
+bool Extension::LoadLaunchContainer(const ManifestValue* manifest,
                                     std::string* error) {
   Value* temp = NULL;
   if (!manifest->Get(keys::kLaunchContainer, &temp))
     return true;
 
   std::string launch_container_string;
   if (!temp->GetAsString(&launch_container_string)) {
     *error = errors::kInvalidLaunchContainer;
     return false;
   }
@@ skipping 32 matching lines @@
     if (!temp->GetAsInteger(&launch_height_) || launch_height_ < 0) {
       launch_height_ = 0;
       *error = errors::kInvalidLaunchHeight;
       return false;
     }
   }
 
   return true;
 }
 
-bool Extension::LoadAppIsolation(const DictionaryValue* manifest,
+bool Extension::LoadAppIsolation(const ManifestValue* manifest,
                                  std::string* error) {
   Value* temp = NULL;
   if (!manifest->Get(keys::kIsolation, &temp))
     return true;
 
   if (temp->GetType() != Value::TYPE_LIST) {
     *error = errors::kInvalidIsolation;
     return false;
   }
 
@@ skipping 11 matching lines @@
     if (isolation_string == values::kIsolatedStorage) {
       is_storage_isolated_ = true;
     } else {
       DLOG(WARNING) << "Did not recognize isolation type: "
                     << isolation_string;
     }
   }
   return true;
 }
 
-bool Extension::LoadWebIntentServices(const base::DictionaryValue& manifest,
+bool Extension::LoadWebIntentServices(const ManifestValue& manifest,
                                       std::string* error) {
   DCHECK(error);
 
   if (!CommandLine::ForCurrentProcess()->HasSwitch(switches::kEnableWebIntents))
     return true;
 
   if (!manifest.HasKey(keys::kIntents))
     return true;
 
   DictionaryValue* all_services = NULL;
@@ skipping 49 matching lines @@
         service.disposition =
             webkit_glue::WebIntentServiceData::DISPOSITION_WINDOW;
       }
     }
 
     intents_services_.push_back(service);
   }
   return true;
 }
 
-
-bool Extension::EnsureNotHybridApp(const DictionaryValue* manifest,
-                                   std::string* error) {
-  if (web_extent().is_empty())
-    return true;
-
-  for (DictionaryValue::key_iterator key = manifest->begin_keys();
-       key != manifest->end_keys(); ++key) {
-    if (!IsBaseCrxKey(*key) &&
-        *key != keys::kApp &&
-        *key != keys::kPermissions &&
-        *key != keys::kOptionalPermissions &&
-        *key != keys::kOptionsPage &&
-        *key != keys::kBackground &&
-        *key != keys::kOfflineEnabled &&
-        *key != keys::kMinimumChromeVersion &&
-        *key != keys::kRequirements) {
-      *error = ExtensionErrorUtils::FormatErrorMessage(
-          errors::kHostedAppsCannotIncludeExtensionFeatures, *key);
-      return false;
-    }
-  }
-
-  return true;
-}
-
 // static
 bool Extension::IsTrustedId(const std::string& id) {
   // See http://b/4946060 for more details.
   return id == std::string("nckgahadagoaajjgafhacjanaoiihapd");
 }
 
 Extension::Extension(const FilePath& path, Location location)
     : manifest_version_(0),
       incognito_split_mode_(false),
       offline_enabled_(false),
@@ skipping 153 matching lines @@
     return *ResourceBundle::GetSharedInstance().GetBitmapNamed(
         IDR_EXTENSION_DEFAULT_ICON);
   }
 }
 
 GURL Extension::GetBaseURLFromExtensionId(const std::string& extension_id) {
   return GURL(std::string(chrome::kExtensionScheme) +
               chrome::kStandardSchemeSeparator + extension_id + "/");
 }
 
-bool Extension::InitFromValue(const DictionaryValue& source, int flags,
+bool Extension::InitFromValue(const ManifestValue& manifest, int flags,
                               std::string* error) {
   DCHECK(error);
   base::AutoLock auto_lock(runtime_data_lock_);
+
+  if (!manifest.ValidateManifest(error))
+    return false;
+
   // When strict error checks are enabled, make URL pattern parsing strict.
   URLPattern::ParseOption parse_strictness =
       (flags & STRICT_ERROR_CHECKS ? URLPattern::ERROR_ON_PORTS
                                    : URLPattern::IGNORE_PORTS);
 
   // Initialize permissions with an empty, default permission set.
   runtime_data_.SetActivePermissions(new ExtensionPermissionSet());
   optional_permission_set_ = new ExtensionPermissionSet();
   required_permission_set_ = new ExtensionPermissionSet();
 
-  if (source.HasKey(keys::kManifestVersion)) {
+  if (manifest.HasKey(keys::kManifestVersion)) {
     int manifest_version = 0;
-    if (!source.GetInteger(keys::kManifestVersion, &manifest_version) ||
+    if (!manifest.GetInteger(keys::kManifestVersion, &manifest_version) ||
         manifest_version < 1) {
       *error = errors::kInvalidManifestVersion;
       return false;
     }
     manifest_version_ = manifest_version;
   } else {
     // Version 1 was the original version, which lacked a version indicator.
     manifest_version_ = 1;
   }
 
-  if (source.HasKey(keys::kPublicKey)) {
+  if (manifest.HasKey(keys::kPublicKey)) {
     std::string public_key_bytes;
-    if (!source.GetString(keys::kPublicKey,
-                          &public_key_) ||
+    if (!manifest.GetString(keys::kPublicKey,
+                         &public_key_) ||
         !ParsePEMKeyBytes(public_key_,
                           &public_key_bytes) ||
         !GenerateId(public_key_bytes, &id_)) {
       *error = errors::kInvalidKey;
       return false;
     }
   } else if (flags & REQUIRE_KEY) {
     *error = errors::kInvalidKey;
     return false;
   } else {
     // If there is a path, we generate the ID from it. This is useful for
     // development mode, because it keeps the ID stable across restarts and
     // reloading the extension.
     id_ = Extension::GenerateIdForPath(path());
     if (id_.empty()) {
       NOTREACHED() << "Could not create ID from path.";
       return false;
     }
   }
 
   creation_flags_ = flags;
 
   // Make a copy of the manifest so we can store it in prefs.
-  manifest_value_.reset(source.DeepCopy());
+  manifest_value_.reset(manifest.DeepCopy());
 
   // Initialize the URL.
   extension_url_ = Extension::GetBaseURLFromExtensionId(id());
 
   // Initialize version.
   std::string version_str;
-  if (!source.GetString(keys::kVersion, &version_str)) {
+  if (!manifest.GetString(keys::kVersion, &version_str)) {
     *error = errors::kInvalidVersion;
     return false;
   }
   version_.reset(Version::GetVersionFromString(version_str));
   if (!version_.get() ||
       version_->components().size() > 4) {
     *error = errors::kInvalidVersion;
     return false;
   }
 
   // Initialize name.
   string16 localized_name;
-  if (!source.GetString(keys::kName, &localized_name)) {
+  if (!manifest.GetString(keys::kName, &localized_name)) {
     *error = errors::kInvalidName;
     return false;
   }
   base::i18n::AdjustStringForLocaleDirection(&localized_name);
   name_ = UTF16ToUTF8(localized_name);
 
   // Load App settings. LoadExtent at least has to be done before
   // ParsePermissions(), because the valid permissions depend on what type of
   // package this is.
-  if (!LoadIsApp(manifest_value_.get(), error) ||
-      !LoadExtent(manifest_value_.get(), keys::kWebURLs,
-                  &extent_,
-                  errors::kInvalidWebURLs, errors::kInvalidWebURL,
-                  parse_strictness, error) ||
-      !EnsureNotHybridApp(manifest_value_.get(), error) ||
-      !LoadLaunchURL(manifest_value_.get(), error) ||
-      !LoadLaunchContainer(manifest_value_.get(), error)) {
+  if (!LoadIsApp(manifest_value_.get(), error))
+    return false;
+
+  if (is_app() &&
+      (!LoadExtent(manifest_value_.get(), keys::kWebURLs,
+                   &extent_,
+                   errors::kInvalidWebURLs, errors::kInvalidWebURL,
+                   parse_strictness, error) ||
+       !LoadLaunchURL(manifest_value_.get(), error) ||
+       !LoadLaunchContainer(manifest_value_.get(), error))) {
     return false;
   }
 
   if (is_platform_app_) {
     if (launch_container() != extension_misc::LAUNCH_PANEL) {
       *error = errors::kInvalidLaunchContainerForPlatform;
       return false;
     }
   }
 
   // Initialize the permissions (optional).
   ExtensionAPIPermissionSet api_permissions;
   URLPatternSet host_permissions;
-  if (!ParsePermissions(&source,
+  if (!ParsePermissions(manifest_value_.get(),
                         keys::kPermissions,
                         flags,
                         error,
                         &api_permissions,
                         &host_permissions)) {
     return false;
   }
 
   // Initialize the optional permissions (optional).
   ExtensionAPIPermissionSet optional_api_permissions;
   URLPatternSet optional_host_permissions;
-  if (!ParsePermissions(&source,
+  if (!ParsePermissions(manifest_value_.get(),
                         keys::kOptionalPermissions,
                         flags,
                         error,
                         &optional_api_permissions,
                         &optional_host_permissions)) {
     return false;
   }
 
   // Initialize description (if present).
-  if (source.HasKey(keys::kDescription)) {
-    if (!source.GetString(keys::kDescription,
+  if (manifest.HasKey(keys::kDescription)) {
+    if (!manifest.GetString(keys::kDescription,
                           &description_)) {
       *error = errors::kInvalidDescription;
       return false;
     }
   }
 
   // Initialize homepage url (if present).
-  if (source.HasKey(keys::kHomepageURL)) {
+  if (manifest.HasKey(keys::kHomepageURL)) {
     std::string tmp;
-    if (!source.GetString(keys::kHomepageURL, &tmp)) {
+    if (!manifest.GetString(keys::kHomepageURL, &tmp)) {
       *error = ExtensionErrorUtils::FormatErrorMessage(
           errors::kInvalidHomepageURL, "");
       return false;
     }
     homepage_url_ = GURL(tmp);
     if (!homepage_url_.is_valid() ||
         (!homepage_url_.SchemeIs("http") &&
             !homepage_url_.SchemeIs("https"))) {
       *error = ExtensionErrorUtils::FormatErrorMessage(
           errors::kInvalidHomepageURL, tmp);
       return false;
     }
   }
 
   // Initialize update url (if present).
-  if (source.HasKey(keys::kUpdateURL)) {
+  if (manifest.HasKey(keys::kUpdateURL)) {
     std::string tmp;
-    if (!source.GetString(keys::kUpdateURL, &tmp)) {
+    if (!manifest.GetString(keys::kUpdateURL, &tmp)) {
       *error = ExtensionErrorUtils::FormatErrorMessage(
           errors::kInvalidUpdateURL, "");
       return false;
     }
     update_url_ = GURL(tmp);
     if (!update_url_.is_valid() ||
         update_url_.has_ref()) {
       *error = ExtensionErrorUtils::FormatErrorMessage(
           errors::kInvalidUpdateURL, tmp);
       return false;
     }
   }
 
   // Validate minimum Chrome version (if present). We don't need to store this,
   // since the extension is not valid if it is incorrect.
-  if (source.HasKey(keys::kMinimumChromeVersion)) {
+  if (manifest.HasKey(keys::kMinimumChromeVersion)) {
     std::string minimum_version_string;
-    if (!source.GetString(keys::kMinimumChromeVersion,
+    if (!manifest.GetString(keys::kMinimumChromeVersion,
                           &minimum_version_string)) {
       *error = errors::kInvalidMinimumChromeVersion;
       return false;
     }
 
     scoped_ptr<Version> minimum_version(
         Version::GetVersionFromString(minimum_version_string));
     if (!minimum_version.get()) {
       *error = errors::kInvalidMinimumChromeVersion;
       return false;
@@ skipping 15 matching lines @@
     if (current_version->CompareTo(*minimum_version) < 0) {
       *error = ExtensionErrorUtils::FormatErrorMessage(
           errors::kChromeVersionTooLow,
           l10n_util::GetStringUTF8(IDS_PRODUCT_NAME),
           minimum_version_string);
       return false;
     }
   }
 
   // Initialize converted_from_user_script (if present)
-  source.GetBoolean(keys::kConvertedFromUserScript,
-                    &converted_from_user_script_);
+  if (manifest.HasKey(keys::kConvertedFromUserScript))
+    manifest.GetBoolean(keys::kConvertedFromUserScript,
+                        &converted_from_user_script_);
 
   // Initialize icons (if present).
-  if (source.HasKey(keys::kIcons)) {
+  if (manifest.HasKey(keys::kIcons)) {
     DictionaryValue* icons_value = NULL;
-    if (!source.GetDictionary(keys::kIcons, &icons_value)) {
+    if (!manifest.GetDictionary(keys::kIcons, &icons_value)) {
       *error = errors::kInvalidIcons;
       return false;
     }
 
     for (size_t i = 0; i < arraysize(kIconSizes); ++i) {
       std::string key = base::IntToString(kIconSizes[i]);
       if (icons_value->HasKey(key)) {
         std::string icon_path;
         if (!icons_value->GetString(key, &icon_path)) {
           *error = ExtensionErrorUtils::FormatErrorMessage(
@@ skipping 10 matching lines @@
           return false;
         }
 
         icons_.Add(kIconSizes[i], icon_path);
       }
     }
   }
 
   // Initialize themes (if present).
   is_theme_ = false;
-  if (source.HasKey(keys::kTheme)) {
-    // Themes cannot contain extension keys.
-    if (ContainsNonThemeKeys(source)) {
-      *error = errors::kThemesCannotContainExtensions;
-      return false;
-    }
-
+  if (manifest.HasKey(keys::kTheme)) {
     DictionaryValue* theme_value = NULL;
-    if (!source.GetDictionary(keys::kTheme, &theme_value)) {
+    if (!manifest.GetDictionary(keys::kTheme, &theme_value)) {
       *error = errors::kInvalidTheme;
       return false;
     }
     is_theme_ = true;
 
     DictionaryValue* images_value = NULL;
     if (theme_value->GetDictionary(keys::kThemeImages, &images_value)) {
       // Validate that the images are all strings
       for (DictionaryValue::key_iterator iter = images_value->begin_keys();
            iter != images_value->end_keys(); ++iter) {
@@ skipping 56 matching lines @@
     if (theme_value->GetDictionary(keys::kThemeDisplayProperties,
         &display_properties_value)) {
       theme_display_properties_.reset(
           display_properties_value->DeepCopy());
     }
 
     return true;
   }
 
   // Initialize plugins (optional).
-  if (source.HasKey(keys::kPlugins)) {
+  if (manifest.HasKey(keys::kPlugins)) {
     ListValue* list_value = NULL;
-    if (!source.GetList(keys::kPlugins, &list_value)) {
+    if (!manifest.GetList(keys::kPlugins, &list_value)) {
       *error = errors::kInvalidPlugins;
       return false;
     }
 
     for (size_t i = 0; i < list_value->GetSize(); ++i) {
       DictionaryValue* plugin_value = NULL;
       std::string path_str;
       bool is_public = false;
 
       if (!list_value->GetDictionary(i, &plugin_value)) {
@@ skipping 21 matching lines @@
       // parse the manifest entry so that error messages are consistently
       // displayed across platforms.
 #if !defined(OS_CHROMEOS)
       plugins_.push_back(PluginInfo());
       plugins_.back().path = path().Append(FilePath::FromUTF8Unsafe(path_str));
       plugins_.back().is_public = is_public;
 #endif
     }
   }
 
-  if (source.HasKey(keys::kNaClModules)) {
+  if (manifest.HasKey(keys::kNaClModules)) {
     ListValue* list_value = NULL;
-    if (!source.GetList(keys::kNaClModules, &list_value)) {
+    if (!manifest.GetList(keys::kNaClModules, &list_value)) {
       *error = errors::kInvalidNaClModules;
       return false;
     }
 
     for (size_t i = 0; i < list_value->GetSize(); ++i) {
       DictionaryValue* module_value = NULL;
       std::string path_str;
       std::string mime_type;
 
       if (!list_value->GetDictionary(i, &module_value)) {
@@ skipping 15 matching lines @@
         return false;
       }
 
       nacl_modules_.push_back(NaClModuleInfo());
       nacl_modules_.back().url = GetResourceURL(path_str);
       nacl_modules_.back().mime_type = mime_type;
     }
   }
 
   // Initialize content scripts (optional).
-  if (source.HasKey(keys::kContentScripts)) {
+  if (manifest.HasKey(keys::kContentScripts)) {
     ListValue* list_value;
-    if (!source.GetList(keys::kContentScripts, &list_value)) {
+    if (!manifest.GetList(keys::kContentScripts, &list_value)) {
       *error = errors::kInvalidContentScriptsList;
       return false;
     }
 
     for (size_t i = 0; i < list_value->GetSize(); ++i) {
       DictionaryValue* content_script = NULL;
       if (!list_value->GetDictionary(i, &content_script)) {
         *error = ExtensionErrorUtils::FormatErrorMessage(
             errors::kInvalidContentScript, base::IntToString(i));
         return false;
       }
 
       UserScript script;
       if (!LoadUserScriptHelper(content_script, i, flags, error, &script))
         return false;  // Failed to parse script context definition.
       script.set_extension_id(id());
       if (converted_from_user_script_) {
         script.set_emulate_greasemonkey(true);
         script.set_match_all_frames(true);  // Greasemonkey matches all frames.
       }
       content_scripts_.push_back(script);
     }
   }
 
   // Initialize page action (optional).
   DictionaryValue* page_action_value = NULL;
 
-  if (source.HasKey(keys::kPageActions)) {
+  if (manifest.HasKey(keys::kPageActions)) {
     ListValue* list_value = NULL;
-    if (!source.GetList(keys::kPageActions, &list_value)) {
+    if (!manifest.GetList(keys::kPageActions, &list_value)) {
       *error = errors::kInvalidPageActionsList;
       return false;
     }
 
     size_t list_value_length = list_value->GetSize();
 
     if (list_value_length == 0u) {
       // A list with zero items is allowed, and is equivalent to not having
       // a page_actions key in the manifest.  Don't set |page_action_value|.
     } else if (list_value_length == 1u) {
       if (!list_value->GetDictionary(0, &page_action_value)) {
         *error = errors::kInvalidPageAction;
         return false;
       }
     } else {  // list_value_length > 1u.
       *error = errors::kInvalidPageActionsListSize;
       return false;
     }
-  } else if (source.HasKey(keys::kPageAction)) {
-    if (!source.GetDictionary(keys::kPageAction, &page_action_value)) {
+  } else if (manifest.HasKey(keys::kPageAction)) {
+    if (!manifest.GetDictionary(keys::kPageAction, &page_action_value)) {
       *error = errors::kInvalidPageAction;
       return false;
     }
   }
 
   // If page_action_value is not NULL, then there was a valid page action.
   if (page_action_value) {
     page_action_.reset(
         LoadExtensionActionHelper(page_action_value, error));
     if (!page_action_.get())
       return false;  // Failed to parse page action definition.
   }
 
   // Initialize browser action (optional).
-  if (source.HasKey(keys::kBrowserAction)) {
+  if (manifest.HasKey(keys::kBrowserAction)) {
     DictionaryValue* browser_action_value = NULL;
-    if (!source.GetDictionary(keys::kBrowserAction, &browser_action_value)) {
+    if (!manifest.GetDictionary(keys::kBrowserAction, &browser_action_value)) {
       *error = errors::kInvalidBrowserAction;
       return false;
     }
 
     browser_action_.reset(
         LoadExtensionActionHelper(browser_action_value, error));
     if (!browser_action_.get())
       return false;  // Failed to parse browser action definition.
   }
 
   // Initialize file browser actions (optional).
-  if (source.HasKey(keys::kFileBrowserHandlers)) {
+  if (manifest.HasKey(keys::kFileBrowserHandlers)) {
     ListValue* file_browser_handlers_value = NULL;
-    if (!source.GetList(keys::kFileBrowserHandlers,
+    if (!manifest.GetList(keys::kFileBrowserHandlers,
                               &file_browser_handlers_value)) {
       *error = errors::kInvalidFileBrowserHandler;
       return false;
     }
 
     file_browser_handlers_.reset(
         LoadFileBrowserHandlers(file_browser_handlers_value, error));
     if (!file_browser_handlers_.get())
       return false;  // Failed to parse file browser actions definition.
   }
 
   // App isolation.
   if (api_permissions.count(ExtensionAPIPermission::kExperimental)) {
-    if (!LoadAppIsolation(manifest_value_.get(), error))
+    if (is_app() && !LoadAppIsolation(manifest_value_.get(), error))
       return false;
   }
 
   // Initialize options page url (optional).
   // Function LoadIsApp() set is_app_ above.
-  if (source.HasKey(keys::kOptionsPage)) {
+  if (manifest.HasKey(keys::kOptionsPage)) {
     std::string options_str;
-    if (!source.GetString(keys::kOptionsPage, &options_str)) {
+    if (!manifest.GetString(keys::kOptionsPage, &options_str)) {
       *error = errors::kInvalidOptionsPage;
       return false;
     }
 
     if (is_hosted_app()) {
       // hosted apps require an absolute URL.
       GURL options_url(options_str);
       if (!options_url.is_valid() ||
           !(options_url.SchemeIs("http") || options_url.SchemeIs("https"))) {
         *error = errors::kInvalidOptionsPageInHostedApp;
         return false;
       }
       options_url_ = options_url;
     } else {
       GURL absolute(options_str);
       if (absolute.is_valid()) {
         *error = errors::kInvalidOptionsPageExpectUrlInPackage;
         return false;
       }
       options_url_ = GetResourceURL(options_str);
       if (!options_url_.is_valid()) {
         *error = errors::kInvalidOptionsPage;
         return false;
       }
     }
   }
 
   // Initialize background url (optional).
-  if (source.HasKey(keys::kBackground)) {
+  if (manifest.HasKey(keys::kBackground)) {
     std::string background_str;
-    if (!source.GetString(keys::kBackground, &background_str)) {
+    if (!manifest.GetString(keys::kBackground, &background_str)) {
       *error = errors::kInvalidBackground;
       return false;
     }
 
     if (is_hosted_app()) {
       // Make sure "background" permission is set.
       if (!api_permissions.count(ExtensionAPIPermission::kBackground)) {
         *error = errors::kBackgroundPermissionNeeded;
         return false;
       }
@@ skipping 10 matching lines @@
             bg_page.SchemeIs("http")))) {
         *error = errors::kInvalidBackgroundInHostedApp;
         return false;
       }
       background_url_ = bg_page;
     } else {
       background_url_ = GetResourceURL(background_str);
     }
   }
 
-  if (source.HasKey(keys::kDefaultLocale)) {
-    if (!source.GetString(keys::kDefaultLocale, &default_locale_) ||
+  if (manifest.HasKey(keys::kDefaultLocale)) {
+    if (!manifest.GetString(keys::kDefaultLocale, &default_locale_) ||
         !l10n_util::IsValidLocaleSyntax(default_locale_)) {
       *error = errors::kInvalidDefaultLocale;
       return false;
     }
   }
 
   // Chrome URL overrides (optional)
-  if (source.HasKey(keys::kChromeURLOverrides)) {
+  if (manifest.HasKey(keys::kChromeURLOverrides)) {
     DictionaryValue* overrides = NULL;
-    if (!source.GetDictionary(keys::kChromeURLOverrides, &overrides)) {
+    if (!manifest.GetDictionary(keys::kChromeURLOverrides, &overrides)) {
       *error = errors::kInvalidChromeURLOverrides;
       return false;
     }
 
     // Validate that the overrides are all strings
     for (DictionaryValue::key_iterator iter = overrides->begin_keys();
          iter != overrides->end_keys(); ++iter) {
       std::string page = *iter;
       std::string val;
       // Restrict override pages to a list of supported URLs.
@@ skipping 21 matching lines @@
     }
 
     // An extension may override at most one page.
     if (overrides->size() > 1) {
       *error = errors::kMultipleOverrides;
       return false;
     }
   }
 
   if (api_permissions.count(ExtensionAPIPermission::kExperimental) &&
-      source.HasKey(keys::kInputComponents)) {
+      manifest.HasKey(keys::kInputComponents)) {
     ListValue* list_value = NULL;
-    if (!source.GetList(keys::kInputComponents, &list_value)) {
+    if (!manifest.GetList(keys::kInputComponents, &list_value)) {
       *error = errors::kInvalidInputComponents;
       return false;
     }
 
     for (size_t i = 0; i < list_value->GetSize(); ++i) {
       DictionaryValue* module_value = NULL;
       std::string name_str;
       InputComponentType type;
       std::string id_str;
       std::string description_str;
@@ skipping 108 matching lines @@
       input_components_.back().description = description_str;
       input_components_.back().language = language_str;
       input_components_.back().layouts.insert(layouts.begin(), layouts.end());
       input_components_.back().shortcut_keycode = shortcut_keycode_str;
       input_components_.back().shortcut_alt = shortcut_alt;
       input_components_.back().shortcut_ctrl = shortcut_ctrl;
       input_components_.back().shortcut_shift = shortcut_shift;
     }
   }
 
-  if (source.HasKey(keys::kOmnibox)) {
-    if (!source.GetString(keys::kOmniboxKeyword, &omnibox_keyword_) ||
+  if (manifest.HasKey(keys::kOmnibox)) {
+    if (!manifest.GetString(keys::kOmniboxKeyword, &omnibox_keyword_) ||
         omnibox_keyword_.empty()) {
       *error = errors::kInvalidOmniboxKeyword;
       return false;
     }
   }
 
-  if (source.HasKey(keys::kContentSecurityPolicy)) {
+  if (manifest.HasKey(keys::kContentSecurityPolicy)) {
     std::string content_security_policy;
-    if (!source.GetString(keys::kContentSecurityPolicy,
+    if (!manifest.GetString(keys::kContentSecurityPolicy,
                           &content_security_policy)) {
       *error = errors::kInvalidContentSecurityPolicy;
       return false;
     }
     // We block these characters to prevent HTTP header injection when
     // representing the content security policy as an HTTP header.
     const char kBadCSPCharacters[] = {'\r', '\n', '\0'};
     if (content_security_policy.find_first_of(kBadCSPCharacters, 0,
                                               arraysize(kBadCSPCharacters)) !=
         std::string::npos) {
       *error = errors::kInvalidContentSecurityPolicy;
       return false;
     }
     content_security_policy_ = content_security_policy;
   } else if (manifest_version_ >= 2) {
     // Manifest version 2 introduced a default Content-Security-Policy.
     // TODO(abarth): Should we continue to let extensions override the
     //               default Content-Security-Policy?
     content_security_policy_ = kDefaultContentSecurityPolicy;
   }
 
   // Initialize devtools page url (optional).
-  if (source.HasKey(keys::kDevToolsPage)) {
+  if (manifest.HasKey(keys::kDevToolsPage)) {
     std::string devtools_str;
-    if (!source.GetString(keys::kDevToolsPage, &devtools_str)) {
+    if (!manifest.GetString(keys::kDevToolsPage, &devtools_str)) {
       *error = errors::kInvalidDevToolsPage;
       return false;
     }
     if (!api_permissions.count(ExtensionAPIPermission::kExperimental)) {
       *error = errors::kDevToolsExperimental;
       return false;
     }
     devtools_url_ = GetResourceURL(devtools_str);
   }
 
   // Initialize sidebar action (optional).
-  if (source.HasKey(keys::kSidebar)) {
+  if (manifest.HasKey(keys::kSidebar)) {
     DictionaryValue* sidebar_value = NULL;
-    if (!source.GetDictionary(keys::kSidebar, &sidebar_value)) {
+    if (!manifest.GetDictionary(keys::kSidebar, &sidebar_value)) {
       *error = errors::kInvalidSidebar;
       return false;
     }
     if (!api_permissions.count(ExtensionAPIPermission::kExperimental)) {
       *error = errors::kSidebarExperimental;
       return false;
     }
     sidebar_defaults_.reset(LoadExtensionSidebarDefaults(sidebar_value, error));
     if (!sidebar_defaults_.get())
       return false;  // Failed to parse sidebar definition.
   }
 
   // Initialize text-to-speech voices (optional).
-  if (source.HasKey(keys::kTtsEngine)) {
+  if (manifest.HasKey(keys::kTtsEngine)) {
     DictionaryValue* tts_dict = NULL;
-    if (!source.GetDictionary(keys::kTtsEngine, &tts_dict)) {
+    if (!manifest.GetDictionary(keys::kTtsEngine, &tts_dict)) {
       *error = errors::kInvalidTts;
       return false;
     }
 
     if (tts_dict->HasKey(keys::kTtsVoices)) {
       ListValue* tts_voices = NULL;
       if (!tts_dict->GetList(keys::kTtsVoices, &tts_voices)) {
         *error = errors::kInvalidTtsVoices;
         return false;
       }
@@ skipping 60 matching lines @@
             voice_data.event_types.insert(event_type);
           }
         }
 
         tts_voices_.push_back(voice_data);
       }
     }
   }
 
   // Initialize web intents (optional).
-  if (!LoadWebIntentServices(source, error))
+  if (!LoadWebIntentServices(manifest, error))
     return false;
 
   // Initialize incognito behavior. Apps default to split mode, extensions
   // default to spanning.
   incognito_split_mode_ = is_app();
-  if (source.HasKey(keys::kIncognito)) {
+  if (manifest.HasKey(keys::kIncognito)) {
     std::string value;
-    if (!source.GetString(keys::kIncognito, &value)) {
+    if (!manifest.GetString(keys::kIncognito, &value)) {
       *error = errors::kInvalidIncognitoBehavior;
       return false;
     }
     if (value == values::kIncognitoSpanning) {
       incognito_split_mode_ = false;
     } else if (value == values::kIncognitoSplit) {
       incognito_split_mode_ = true;
     } else {
       *error = errors::kInvalidIncognitoBehavior;
       return false;
     }
   }
 
   // Initialize offline-enabled status. Defaults to false.
-  if (source.HasKey(keys::kOfflineEnabled)) {
-    if (!source.GetBoolean(keys::kOfflineEnabled, &offline_enabled_)) {
+  if (manifest.HasKey(keys::kOfflineEnabled)) {
+    if (!manifest.GetBoolean(keys::kOfflineEnabled, &offline_enabled_)) {
       *error = errors::kInvalidOfflineEnabled;
       return false;
     }
   }
 
   // Initialize requirements (optional). Not actually persisted (they're only
   // used by the store), but still validated.
-  if (source.HasKey(keys::kRequirements)) {
+  if (manifest.HasKey(keys::kRequirements)) {
     DictionaryValue* requirements_value = NULL;
-    if (!source.GetDictionary(keys::kRequirements, &requirements_value)) {
+    if (!manifest.GetDictionary(keys::kRequirements, &requirements_value)) {
       *error = errors::kInvalidRequirements;
       return false;
     }
 
     for (DictionaryValue::key_iterator it = requirements_value->begin_keys();
          it != requirements_value->end_keys(); ++it) {
       DictionaryValue* requirement_value;
       if (!requirements_value->GetDictionaryWithoutPathExpansion(
           *it, &requirement_value)) {
         *error = ExtensionErrorUtils::FormatErrorMessage(
             errors::kInvalidRequirement, *it);
         return false;
       }
     }
   }
 
   if (HasMultipleUISurfaces()) {
     *error = errors::kOneUISurfaceOnly;
     return false;
   }
 
   runtime_data_.SetActivePermissions(new ExtensionPermissionSet(
       this, api_permissions, host_permissions));
   required_permission_set_ = new ExtensionPermissionSet(
       this, api_permissions, host_permissions);
   optional_permission_set_ = new ExtensionPermissionSet(
       optional_api_permissions, optional_host_permissions, URLPatternSet());
 
-  // Although |source| is passed in as a const, it's still possible to modify
-  // it.  This is dangerous since the utility process re-uses |source| after
+  // Although |manifest| is passed in as a const, it's still possible to modify
+  // it.  This is dangerous since the utility process re-uses |manifest| after
   // it calls InitFromValue, passing it up to the browser process which calls
   // InitFromValue again.  As a result, we need to make sure that nobody
   // accidentally modifies it.
-  DCHECK(source.Equals(manifest_value_.get()));
+  DCHECK(manifest.Equals(manifest_value_.get()));
 
   return true;
 }
 
 GURL Extension::GetHomepageURL() const {
   if (homepage_url_.is_valid())
     return homepage_url_;
 
   if (!UpdatesFromGallery())
     return GURL();
@@ skipping 136 matching lines @@
 
 GURL Extension::GetIconURL(int size,
                            ExtensionIconSet::MatchType match_type) const {
   std::string path = icons().Get(size, match_type);
   if (path.empty())
     return GURL();
   else
     return GetResourceURL(path);
 }
 
-bool Extension::ParsePermissions(const DictionaryValue* source,
+bool Extension::ParsePermissions(const ManifestValue* source,
                                  const char* key,
                                  int flags,
                                  std::string* error,
                                  ExtensionAPIPermissionSet* api_permissions,
                                  URLPatternSet* host_permissions) {
   if (source->HasKey(key)) {
     // When strict error checks are enabled, make URL pattern parsing strict.
     URLPattern::ParseOption parse_strictness =
         (flags & STRICT_ERROR_CHECKS ? URLPattern::ERROR_ON_PORTS
                                      : URLPattern::IGNORE_PORTS);
@@ skipping 458 matching lines @@
     already_disabled(false),
     extension(extension) {}
 
 UpdatedExtensionPermissionsInfo::UpdatedExtensionPermissionsInfo(
     const Extension* extension,
     const ExtensionPermissionSet* permissions,
     Reason reason)
     : reason(reason),
       extension(extension),
       permissions(permissions) {}