Add a centralized mechanism for whitelisting access to extension permissions.

chrome/common/extensions/extension_permission_set.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_COMMON_EXTENSIONS_EXTENSION_PERMISSION_SET_H_
 #define CHROME_COMMON_EXTENSIONS_EXTENSION_PERMISSION_SET_H_
 #pragma once
 
 #include <map>
 #include <set>
 #include <string>
 #include <vector>
 
 #include "base/gtest_prod_util.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/singleton.h"
 #include "base/string16.h"
 #include "chrome/common/extensions/url_pattern_set.h"
 
+// TODO(jstritar): Move each class to its own file in extensions/permissions.
+
 class Extension;
 class ExtensionPermissionsInfo;
 
 // When prompting the user to install or approve permissions, we display
 // messages describing the effects of the permissions rather than listing the
 // permissions themselves. Each ExtensionPermissionMessage represents one of the
 // messages shown to the user.
 class ExtensionPermissionMessage {
  public:
   // Do not reorder this enumeration. If you need to add a new enum, add it just
@@ skipping 112 matching lines @@
     kFlagImpliesFullAccess = 1 << 0,
 
     // Indicates if the permission implies full URL access.
     kFlagImpliesFullURLAccess = 1 << 1,
 
     // Indicates that the permission is private to COMPONENT extensions.
     kFlagComponentOnly = 1 << 2,
 
     // Indicates that extensions cannot specify the permission as optional.
     kFlagCannotBeOptional = 1 << 3,
+
+    // When set, the permission can only be acquired by extensions on the
+    // permission's whitelist. Extensions must pass both tests when used in
+    // conjunction with kFlagComponentOnly.
+    kFlagEnforceWhitelist = 1 << 4,

[Aaron Boodman, 2012/02/02 08:09:24]

Using 'and' here doesn't seem very useful. Are there really cases where we want
to restrict to a whitelist of specific component extensions? If we wanted that,
why not just use the whitelist only? Since they are component extensions, we
know their IDs ahead of time, and the design of the extension system makes it
impossible (for practical definitions) to spoof an ID.

More broadly, why have this flag at all? Why not just: AddToWhitelist(),
IsWhitelisted(), and HasWhitelist()?

The RegisterPermission() call could be changed to return the APIPermission
instance, and then the caller could call AddToWhitelist() as needed.

This seems like it would simplify the implementation and usage of this
functionality. You could also get rid of the RegisterWhitelist() methods that
way.

[jstritar, 2012/02/02 17:51:10]

Done and deprecated kFlagComponentOnly.

   };
 
   // Flags for specifying what extension types can use the permission.
   enum TypeRestriction {
     kTypeNone = 0,
 
     // Extension::TYPE_EXTENSION and Extension::TYPE_USER_SCRIPT
     kTypeExtension = 1 << 0,
 
     // Extension::TYPE_HOSTED_APP
@@ skipping 42 matching lines @@
   bool implies_full_url_access() const {
     return (flags_ & kFlagImpliesFullURLAccess) != 0;
   }
 
   // Returns true if this permission can only be acquired by COMPONENT
   // extensions.
   bool is_component_only() const {
     return (flags_ & kFlagComponentOnly) != 0;
   }
 
+  // Returns true if |extension_id| is whitelisted. You should only use this
+  // method if should_enforce_whitelist() is true.

[Aaron Boodman, 2012/02/02 08:09:24]

Why is the second sentence important to note?

[jstritar, 2012/02/02 17:51:10]

Updated comment.

+  bool IsWhitelisted(const std::string& extension_id) const;
+
+  // Returns true if access to this permission is restricted by a whitelist.
+  bool should_enforce_whitelist() const {
+    return (flags_ & kFlagEnforceWhitelist) != 0;
+  }
+
   // Returns true if regular extensions can specify this permission.
   bool supports_extensions() const {
     return (type_restrictions_ & kTypeExtension) != 0;
   }
 
   // Returns true if hosted apps can specify this permission.
   bool supports_hosted_apps() const {
     return (type_restrictions_ & kTypeHostedApp) != 0;
   }
 
@@ skipping 18 matching lines @@
     return (type_restrictions_ & type) != 0;
   }
 
  private:
   // Instances should only be constructed from within ExtensionPermissionsInfo.
   friend class ExtensionPermissionsInfo;
 
   // Register ALL the permissions!
   static void RegisterAllPermissions(ExtensionPermissionsInfo* info);
 
+  // Register the permission whitelists.
+  static void RegisterWhitelists(ExtensionPermissionsInfo* info);

[Aaron Boodman, 2012/02/02 08:09:24]

Not clear what this method does from just its name and comments.

[jstritar, 2012/02/02 17:51:10]

Removed method.

+
+  typedef std::set<std::string> ExtensionWhitelist;
+
   explicit ExtensionAPIPermission(
       ID id,
       const char* name,
       int l10n_message_id,
       ExtensionPermissionMessage::ID message_id,
       int flags,
       int type_restrictions);
 
+  // Adds |extension_id| to the whitelist for this permission.
+  // The kFlagEnforceWhitelist flag must be set to use this method.
+  void AddToWhitelist(const std::string& extension_id);
+
   ID id_;
   const char* name_;
   int flags_;
   int type_restrictions_;
   int l10n_message_id_;
   ExtensionPermissionMessage::ID message_id_;
+  ExtensionWhitelist whitelist_;
 };
 
 typedef std::set<ExtensionAPIPermission::ID> ExtensionAPIPermissionSet;
 
 // Singleton that holds the extension permission instances and provides static
 // methods for accessing them.
 class ExtensionPermissionsInfo {
  public:
   // Returns a pointer to the singleton instance.
   static ExtensionPermissionsInfo* GetInstance();
@@ skipping 26 matching lines @@
 
   // Registers a permission with the specified attributes and flags.
   void RegisterPermission(
       ExtensionAPIPermission::ID id,
       const char* name,
       int l10n_message_id,
       ExtensionPermissionMessage::ID message_id,
       int flags,
       int type_restrictions);
 
+  // Registers the whitelist for the given permission.
+  void RegisterWhitelist(ExtensionAPIPermission::ID id,
+                         const char* whitelist[],
+                         int whitelist_length);
+
   // Maps permission ids to permissions.
   typedef std::map<ExtensionAPIPermission::ID, ExtensionAPIPermission*> IDMap;
 
   // Maps names and aliases to permissions.
   typedef std::map<std::string, ExtensionAPIPermission*> NameMap;
 
   IDMap id_map_;
   NameMap name_map_;
 
   size_t hosted_app_permission_count_;
@@ skipping 105 matching lines @@
 
   const ExtensionAPIPermissionSet& apis() const { return apis_; }
 
   const URLPatternSet& effective_hosts() const { return effective_hosts_; }
 
   const URLPatternSet& explicit_hosts() const { return explicit_hosts_; }
 
   const URLPatternSet& scriptable_hosts() const { return scriptable_hosts_; }
 
  private:
-  FRIEND_TEST_ALL_PREFIXES(ExtensionPermissionSetTest,
+  FRIEND_TEST_ALL_PREFIXES(ExtensionPermissionsTest,
                            HasLessHostPrivilegesThan);
 
   friend class base::RefCountedThreadSafe<ExtensionPermissionSet>;
 
   static std::set<std::string> GetDistinctHosts(
       const URLPatternSet& host_patterns,
       bool include_rcd,
       bool exclude_file_scheme);
 
   // Initializes the set based on |extension|'s manifest data.
@@ skipping 25 matching lines @@
 
   // The list of hosts that can be scripted by content scripts.
   // TODO(jstritar): Rename to "user_script_hosts_"?
   URLPatternSet scriptable_hosts_;
 
   // The list of hosts this effectively grants access to.
   URLPatternSet effective_hosts_;
 };
 
 #endif  // CHROME_COMMON_EXTENSIONS_EXTENSION_PERMISSION_SET_H_