Do not pass URLs in onUpdated events to extensions unless they have the

chrome/browser/extensions/extension_tab_util.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_EXTENSIONS_EXTENSION_TAB_UTIL_H__
 #define CHROME_BROWSER_EXTENSIONS_EXTENSION_TAB_UTIL_H__
 
 #include <string>
 
 #include "base/callback.h"
@@ skipping 27 matching lines @@
  public:
   static int GetWindowId(const Browser* browser);
   static int GetWindowIdOfTabStripModel(const TabStripModel* tab_strip_model);
   static int GetTabId(const content::WebContents* web_contents);
   static std::string GetTabStatusText(bool is_loading);
   static int GetWindowIdOfTab(const content::WebContents* web_contents);
   static base::ListValue* CreateTabList(
       const Browser* browser,
       const extensions::Extension* extension);
 
+  // Creates a Tab object (a Javascript dictionary with information about the
+  // status of a browser tab).  Depending on the permissions of the extension,

[not at google - send to devlin, 2013/01/09 02:04:29]

"A Javascript dictionary..." is a bit misleading, though referencing its schema
in tabs.json would be good.

[mvrable, 2013/01/09 19:25:35]

Done.

+  // the object may or may not include sensitive data such as the tab's URL.
   static base::DictionaryValue* CreateTabValue(
       const content::WebContents* web_contents,
       const extensions::Extension* extension) {
     return CreateTabValue(web_contents, NULL, -1, extension);
   }
   static base::DictionaryValue* CreateTabValue(
       const content::WebContents* web_contents,
       TabStripModel* tab_strip,
       int tab_index,
       const extensions::Extension* extension);
 
-  enum IncludePrivacySensitiveFields {
-    INCLUDE_PRIVACY_SENSITIVE_FIELDS,
-    OMIT_PRIVACY_SENSITIVE_FIELDS
-  };
+  // Creates a Tab object but performs no extension permissions checks; the
+  // returned object will contain privacy-sensitive data.
   static base::DictionaryValue* CreateTabValue(
-      const content::WebContents* web_contents,
-      IncludePrivacySensitiveFields include_privacy_sensitive_fields) {
-    return CreateTabValue(web_contents, NULL, -1,
-                          include_privacy_sensitive_fields);
+      const content::WebContents* web_contents) {
+    return CreateTabValue(web_contents, NULL, -1);
   }
   static base::DictionaryValue* CreateTabValue(
       const content::WebContents* web_contents,
       TabStripModel* tab_strip,
-      int tab_index,
-      IncludePrivacySensitiveFields include_privacy_sensitive_fields);
+      int tab_index);
+
+  // Removes any privacy-sensitive fields from a Tab object if appropriate,
+  // given the permissions of the extension and the tab in question.  The
+  // tab_info object is modified in place.
+  static base::DictionaryValue* ScrubTabValueForExtension(
+      const content::WebContents* contents,
+      const extensions::Extension* extension,
+      base::DictionaryValue* tab_info);
 
   // Gets the |tab_strip_model| and |tab_index| for the given |web_contents|.
   static bool GetTabStripModel(const content::WebContents* web_contents,
                                TabStripModel** tab_strip_model,
                                int* tab_index);
   static bool GetDefaultTab(Browser* browser,
                             content::WebContents** contents,
                             int* tab_id);
   // Any out parameter (|browser|, |tab_strip|, |contents|, & |tab_index|) may
   // be NULL and will not be set within the function.
@@ skipping 26 matching lines @@
 
   // Executes the specified callback for all tabs in all browser windows.
   static void ForEachTab(
       const base::Callback<void(content::WebContents*)>& callback);
 
   static extensions::WindowController* GetWindowControllerOfTab(
       const content::WebContents* web_contents);
 };
 
 #endif  // CHROME_BROWSER_EXTENSIONS_EXTENSION_TAB_UTIL_H__