Restrict chrome.runtime.setUninstallURL to http(s)

extensions/browser/api/runtime/runtime_api.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/runtime/runtime_api.h"
 
 #include <utility>
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
@@ skipping 36 matching lines @@
 const char kNoBackgroundPageError[] = "You do not have a background page.";
 const char kPageLoadError[] = "Background page failed to load.";
 const char kFailedToCreateOptionsPage[] = "Could not create an options page.";
 const char kInstallId[] = "id";
 const char kInstallReason[] = "reason";
 const char kInstallReasonChromeUpdate[] = "chrome_update";
 const char kInstallReasonUpdate[] = "update";
 const char kInstallReasonInstall[] = "install";
 const char kInstallReasonSharedModuleUpdate[] = "shared_module_update";
 const char kInstallPreviousVersion[] = "previousVersion";
-const char kInvalidUrlError[] = "Invalid URL.";
+const char kInvalidUrlError[] = "Invalid URL: \"*\".";
 const char kPlatformInfoUnavailable[] = "Platform information unavailable.";
 
 const char kUpdatesDisabledError[] = "Autoupdate is not enabled.";
 
 // A preference key storing the url loaded when an extension is uninstalled.
 const char kUninstallUrl[] = "uninstall_url";
 
 // The name of the directory to be returned by getPackageDirectoryEntry. This
 // particular value does not matter to user code, but is chosen for consistency
 // with the equivalent Pepper API.
@@ skipping 330 matching lines @@
     const std::string& extension_id,
     UninstallReason reason) {
   if (!(reason == UNINSTALL_REASON_USER_INITIATED ||
         reason == UNINSTALL_REASON_MANAGEMENT_API)) {
     return;
   }
 
   GURL uninstall_url(
       GetUninstallURL(ExtensionPrefs::Get(context), extension_id));
 
-  if (uninstall_url.is_empty())
+  if (uninstall_url.is_empty() || !uninstall_url.SchemeIsHTTPOrHTTPS())

[not at google - send to devlin, 2015/08/10 22:33:02]

Second half of check is enough, and it's worth commenting like:

if (!uninstall_url.SchemeIsHTTPOrHTTPS()) {
  // In previous versions of Chrome non-http[s] URLs were allowed,
  // and may be stored in prefs. Now, they're disallowed, but old data
  // may exist.
  return;
}

     return;
 
   RuntimeAPI::GetFactoryInstance()->Get(context)->OpenURL(uninstall_url);
 }
 
 ExtensionFunction::ResponseAction RuntimeGetBackgroundPageFunction::Run() {
   ExtensionHost* host = ProcessManager::Get(browser_context())
                             ->GetBackgroundHostForExtension(extension_id());
   if (LazyBackgroundTaskQueue::Get(browser_context())
           ->ShouldEnqueueTask(browser_context(), extension())) {
@@ skipping 22 matching lines @@
   RuntimeAPI* api = RuntimeAPI::GetFactoryInstance()->Get(browser_context());
   return RespondNow(api->OpenOptionsPage(extension())
                         ? NoArguments()
                         : Error(kFailedToCreateOptionsPage));
 }
 
 ExtensionFunction::ResponseAction RuntimeSetUninstallURLFunction::Run() {
   std::string url_string;
   EXTENSION_FUNCTION_VALIDATE(args_->GetString(0, &url_string));
 
-  GURL url(url_string);
-  if (!url.is_valid()) {
-    return RespondNow(
-        Error(ErrorUtils::FormatErrorMessage(kInvalidUrlError, url_string)));
+  if (!url_string.empty()) {
+    GURL url(url_string);
+    if (!url.is_valid() || !url.SchemeIsHTTPOrHTTPS()) {
+      return RespondNow(
+          Error(ErrorUtils::FormatErrorMessage(kInvalidUrlError, url_string)));
+    }
   }

[not at google - send to devlin, 2015/08/10 22:33:02]

likewise here it could be just

if (!url_string.empty() && !GURL(url_string).SchemeIsHTTPOrHTTPS()) {
  return RespondNow(Error(kInvalidUrlError, url_string));
}


^^^ (yes you can simplify Error(ErrorUtils::FormatErrorMessage(kInvalidUrlError,
url_string)) --> Error(kInvalidUrlError, url_string))

   SetUninstallURL(
       ExtensionPrefs::Get(browser_context()), extension_id(), url_string);
   return RespondNow(NoArguments());
 }
 
 ExtensionFunction::ResponseAction RuntimeReloadFunction::Run() {
   RuntimeAPI::GetFactoryInstance()->Get(browser_context())->ReloadExtension(
       extension_id());
   return RespondNow(NoArguments());
 }
@@ skipping 59 matching lines @@
   content::ChildProcessSecurityPolicy* policy =
       content::ChildProcessSecurityPolicy::GetInstance();
   policy->GrantReadFileSystem(renderer_id, filesystem_id);
   base::DictionaryValue* dict = new base::DictionaryValue();
   dict->SetString("fileSystemId", filesystem_id);
   dict->SetString("baseName", relative_path);
   return RespondNow(OneArgument(dict));
 }
 
 }  // namespace extensions