Supervised users: Don't URLEscape extension update requests

chrome/browser/supervised_user/legacy/permission_request_creator_sync.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/supervised_user/legacy/permission_request_creator_sync.h"
 
 #include "base/callback.h"
 #include "base/values.h"
 #include "chrome/browser/supervised_user/legacy/supervised_user_shared_settings_service.h"
 #include "chrome/browser/supervised_user/supervised_user_settings_service.h"
@@ skipping 34 matching lines @@
   // We allow requesting access if Sync is working or has a transient error.
   return (state == GoogleServiceAuthError::NONE ||
           state == GoogleServiceAuthError::CONNECTION_FAILED ||
           state == GoogleServiceAuthError::SERVICE_UNAVAILABLE);
 }
 
 void PermissionRequestCreatorSync::CreateURLAccessRequest(
     const GURL& url_requested,
     const SuccessCallback& callback) {
   CreateRequest(kSupervisedUserAccessRequestKeyPrefix,
-                url_requested.spec(),
+                net::EscapeQueryParamValue(url_requested.spec(), true),
                 callback);
 }
 
 void PermissionRequestCreatorSync::CreateExtensionUpdateRequest(
     const std::string& id,
     const SuccessCallback& callback) {
   CreateRequest(kSupervisedUserUpdateRequestKeyPrefix, id, callback);
 }
 
 void PermissionRequestCreatorSync::CreateRequest(
     const std::string& prefix,
     const std::string& data,
     const SuccessCallback& callback) {
-  // Escape the data string and add the prefix.
-  std::string key = SupervisedUserSettingsService::MakeSplitSettingKey(
-      prefix,
-      net::EscapeQueryParamValue(data, true));
+  // Add the prefix.

[Pam (message me for reviews), 2015/03/27 12:13:54]

Please add a note to the corresponding .h file mentioning that callers are
responsible for escaping the data.

[Marc Treib, 2015/03/27 12:19:16]

This is a private method. CreateURLAccessRequest above is the public one, and
that one still does the escaping.

+  std::string key =
+      SupervisedUserSettingsService::MakeSplitSettingKey(prefix, data);
 
   scoped_ptr<base::DictionaryValue> dict(new base::DictionaryValue);
   // TODO(sergiu): Use sane time here when it's ready.
   dict->SetDouble(kSupervisedUserAccessRequestTime,
                   base::Time::Now().ToJsTime());
   dict->SetString(kSupervisedUserName, name_);
 
   // Copy the notification setting of the custodian.
   const base::Value* value = shared_settings_service_->GetValue(
       supervised_user_id_, kNotificationSetting);
   bool notifications_enabled = false;
   if (value) {
     bool success = value->GetAsBoolean(&notifications_enabled);
     DCHECK(success);
   }
   dict->SetBoolean(kNotificationSetting, notifications_enabled);
 
   settings_service_->UploadItem(key, dict.Pass());
 
   callback.Run(true);
 }