Add a centralized mechanism for whitelisting access to extension permissions.

chrome/common/extensions/extension.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/extension.h"
 
 #include <algorithm>
 
 #include "base/base64.h"
 #include "base/basictypes.h"
@@ skipping 2817 matching lines @@
 
 bool Extension::ImplicitlyDelaysNetworkStartup() const {
   // Network requests should be deferred until any extensions that might want
   // to observe and modify them are loaded.
   return HasAPIPermission(ExtensionAPIPermission::kWebRequestBlocking);
 }
 
 bool Extension::CanSpecifyAPIPermission(
     const ExtensionAPIPermission* permission,
     string16* error) const {
-  if (permission->is_component_only()) {
-    if (!CanSpecifyComponentOnlyPermission()) {
-      *error = ExtensionErrorUtils::FormatErrorMessageUTF16(
-          errors::kPermissionNotAllowed, permission->name());
-      return false;
-    }
+  if (location_ == Extension::COMPONENT)
+    return true;
+
+  bool access_denied = false;
+  if (permission->HasWhitelist()) {
+    if (permission->IsWhitelisted(id_))
+      return true;
+    else
+      access_denied = true;
+  } else if (permission->is_component_only()) {
+    access_denied = true;
+  }
+
+  if (access_denied) {
+    *error = ExtensionErrorUtils::FormatErrorMessageUTF16(
+        errors::kPermissionNotAllowed, permission->name());
+    return false;
   }
 
   if (permission->id() == ExtensionAPIPermission::kExperimental) {
     if (!CanSpecifyExperimentalPermission()) {
       *error = ASCIIToUTF16(errors::kExperimentalFlagRequired);
       return false;
     }
   }
 
-  if (location_ == Extension::COMPONENT)
-    return true;
-
   bool supports_type = false;
   switch (GetType()) {
     case TYPE_USER_SCRIPT: // Pass through.
     case TYPE_EXTENSION:
       supports_type = permission->supports_extensions();
       break;
     case TYPE_HOSTED_APP:
       supports_type = permission->supports_hosted_apps();
       break;
     case TYPE_PACKAGED_APP:
@@ skipping 19 matching lines @@
     if (!is_hosted_app() || creation_flags_ & STRICT_ERROR_CHECKS) {
       *error = ExtensionErrorUtils::FormatErrorMessageUTF16(
           errors::kPermissionNotAllowed, permission->name());
     }
     return false;
   }
 
   return true;
 }
 
-bool Extension::CanSpecifyComponentOnlyPermission() const {
-  // Only COMPONENT extensions can use private APIs.
-  // TODO(asargent) - We want a more general purpose mechanism for this,
-  // and better error messages. (http://crbug.com/54013)
-  return location_ == Extension::COMPONENT;
-}
-
 bool Extension::CanSpecifyExperimentalPermission() const {
   if (location_ == Extension::COMPONENT)
     return true;
 
   if (CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kEnableExperimentalExtensionApis)) {
     return true;
   }
 
   // We rely on the webstore to check access to experimental. This way we can
@@ skipping 135 matching lines @@
     already_disabled(false),
     extension(extension) {}
 
 UpdatedExtensionPermissionsInfo::UpdatedExtensionPermissionsInfo(
     const Extension* extension,
     const ExtensionPermissionSet* permissions,
     Reason reason)
     : reason(reason),
       extension(extension),
       permissions(permissions) {}