Do not pass URLs in onUpdated events to extensions unless they have the

chrome/test/data/extensions/api_test/tabs/no_permissions/test.js

+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+chrome.test.runTests([
+  function testOnUpdated() {
+    var expectedEventData = [{ status: 'loading' }, { status: 'complete' }];
+    var capturedEventData = [];
+
+    function onUpdateListener(tabId, info, tab) {
+      capturedEventData.push(info);
+      if (capturedEventData.length < expectedEventData.length) {
+        return;
+      }

[not at google - send to devlin, 2013/01/09 22:30:15]

nit: single-line ifs omit {}

[mvrable, 2013/01/09 23:03:14]

Done.

+      chrome.tabs.onUpdated.removeListener(onUpdateListener);
+      chrome.test.assertEq(expectedEventData, capturedEventData);
+      chrome.test.succeed();
+    }
+
+    chrome.tabs.onUpdated.addListener(onUpdateListener);
+    chrome.tabs.create({ url: 'chrome://newtab/' });

[not at google - send to devlin, 2013/01/09 22:30:15]

mm, you should also test changing the URL or title and making sure that property
doesn't get set.

[mvrable, 2013/01/09 23:03:14]

Done.

+  },
+
+  function testQuery() {
+    chrome.tabs.create({ url: 'chrome://newtab/' });
+    chrome.tabs.query({active: true}, chrome.test.callbackPass(function(tabs) {
+      chrome.test.assertEq(1, tabs.length);
+      chrome.test.assertEq(undefined, tabs[0].url);

[not at google - send to devlin, 2013/01/09 22:30:15]

you could add the other sensitive properties here too?

['url', 'title', 'faviconUrl'].forEach(...)

[mvrable, 2013/01/09 23:03:14]

Done (implemented as a separate check function so it can be re-used).

+    }));
+  },
+
+]);