Do not pass URLs in onUpdated events to extensions unless they have the

chrome/browser/extensions/api/messaging/message_service.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/messaging/message_service.h"
 
 #include "base/atomic_sequence_num.h"
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/json/json_writer.h"
@@ skipping 144 matching lines @@
   MessagePort* receiver = new ExtensionMessagePort(
       GetExtensionProcess(profile, target_extension_id), MSG_ROUTING_CONTROL,
       target_extension_id);
   WebContents* source_contents = tab_util::GetWebContentsByID(
       source_process_id, source_routing_id);
 
   // Include info about the opener's tab (if it was a tab).
   std::string tab_json = "null";
   if (source_contents) {
     scoped_ptr<DictionaryValue> tab_value(ExtensionTabUtil::CreateTabValue(
-        source_contents, ExtensionTabUtil::INCLUDE_PRIVACY_SENSITIVE_FIELDS));
+        source_contents));
     base::JSONWriter::Write(tab_value.get(), &tab_json);
   }
 
   OpenChannelParams* params = new OpenChannelParams(source, tab_json, receiver,
                                                     receiver_port_id,
                                                     source_extension_id,
                                                     target_extension_id,
                                                     channel_name);
 
   // The target might be a lazy background page. In that case, we have to check
@@ skipping 19 matching lines @@
   if (!source)
     return;
 
   WebContents* source_contents = tab_util::GetWebContentsByID(
       source_process_id, source_routing_id);
 
   // Include info about the opener's tab (if it was a tab).
   std::string tab_json = "null";
   if (source_contents) {
     scoped_ptr<DictionaryValue> tab_value(ExtensionTabUtil::CreateTabValue(
-        source_contents, ExtensionTabUtil::INCLUDE_PRIVACY_SENSITIVE_FIELDS));
+        source_contents));
     base::JSONWriter::Write(tab_value.get(), &tab_json);
   }
 
   scoped_ptr<MessageChannel> channel(new MessageChannel());
   channel->opener.reset(new ExtensionMessagePort(source, MSG_ROUTING_CONTROL,
                                                  source_extension_id));
 
   NativeMessageProcessHost::MessageType type =
       channel_name == "chrome.runtime.sendNativeMessage" ?
       NativeMessageProcessHost::TYPE_SEND_MESSAGE_REQUEST :
@@ skipping 64 matching lines @@
     return;
   }
 
   WebContents* source_contents = tab_util::GetWebContentsByID(
       source_process_id, source_routing_id);
 
   // Include info about the opener's tab (if it was a tab).
   std::string tab_json = "null";
   if (source_contents) {
     scoped_ptr<DictionaryValue> tab_value(ExtensionTabUtil::CreateTabValue(
-        source_contents, ExtensionTabUtil::INCLUDE_PRIVACY_SENSITIVE_FIELDS));
+        source_contents));
     base::JSONWriter::Write(tab_value.get(), &tab_json);
   }
 
   scoped_ptr<OpenChannelParams> params(new OpenChannelParams(source, tab_json,
                                                              receiver.release(),
                                                              receiver_port_id,
                                                              extension_id,
                                                              extension_id,
                                                              channel_name));
   OpenChannelImpl(params.Pass());
@@ skipping 199 matching lines @@
     return;
 
   params->source = source;
   params->receiver.reset(new ExtensionMessagePort(host->render_process_host(),
                                                   MSG_ROUTING_CONTROL,
                                                   params->target_extension_id));
   OpenChannelImpl(params.Pass());
 }
 
 }  // namespace extensions