WebRequest API should warn when a developer attempts to filter URLs without proper permissions

chrome/browser/extensions/extension_webrequest_api.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_webrequest_api.h"
 
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/json/json_writer.h"
@@ skipping 1517 matching lines @@
   // 'webRequestBlocking'.
   if ((extra_info_spec &
           (ExtensionWebRequestEventRouter::ExtraInfoSpec::BLOCKING |
            ExtensionWebRequestEventRouter::ExtraInfoSpec::ASYNC_BLOCKING)) &&
        !extension->HasAPIPermission(
            ExtensionAPIPermission::kWebRequestBlocking)) {
     error_ = keys::kBlockingPermissionRequired;
     return false;
   }
 
+  // We allow to subscribe to patterns that are broader than the host
+  // permissions. E.g., we could subscribe to http://www.example.com/*
+  // while having host permissions for http://www.example.com/foo/* and
+  // http://www.example.com/bar/*.
+  // For this reason we do only a coarse check here to warn the extension
+  // developer if he does something obviously wrong.
+  if (extension->GetEffectiveHostPermissions().is_empty()) {
+    error_ = keys::kHostPermissionsRequired;
+    return false;
+  }
+
   ExtensionWebRequestEventRouter::GetInstance()->AddEventListener(
       profile_id(), extension_id(), extension_name,
       event_name, sub_event_name, filter,
       extra_info_spec, ipc_sender_weak());
 
   BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
                           base::Bind(&ClearCacheOnNavigationOnUI));
 
   BrowserThread::PostTask(BrowserThread::UI, FROM_HERE, base::Bind(
       &NotifyWebRequestAPIUsed,
@@ skipping 163 matching lines @@
       } else if ((*it)->name().find("AdBlock") != std::string::npos) {
         adblock = true;
       } else {
         other = true;
       }
     }
   }
 
   host->Send(new ExtensionMsg_UsingWebRequestAPI(adblock, adblock_plus, other));
 }