Restrict chrome.runtime.setUninstallURL to http(s)

extensions/browser/api/runtime/runtime_api.cc

Index: extensions/browser/api/runtime/runtime_api.cc
diff --git a/extensions/browser/api/runtime/runtime_api.cc b/extensions/browser/api/runtime/runtime_api.cc
index 09ffef2c864b5d6d902beb76f8d51d6eba2fc33e..16b7de37ac93726b85625ff75473fdae9d0a2307 100644
--- a/extensions/browser/api/runtime/runtime_api.cc
+++ b/extensions/browser/api/runtime/runtime_api.cc
@@ -54,7 +54,7 @@ const char kInstallReasonUpdate[] = "update";
 const char kInstallReasonInstall[] = "install";
 const char kInstallReasonSharedModuleUpdate[] = "shared_module_update";
 const char kInstallPreviousVersion[] = "previousVersion";
-const char kInvalidUrlError[] = "Invalid URL.";
+const char kInvalidUrlError[] = "Invalid URL: \"*\".";
 const char kPlatformInfoUnavailable[] = "Platform information unavailable.";
 
 const char kUpdatesDisabledError[] = "Autoupdate is not enabled.";
@@ -405,7 +405,7 @@ void RuntimeEventRouter::OnExtensionUninstalled(
   GURL uninstall_url(
       GetUninstallURL(ExtensionPrefs::Get(context), extension_id));
 
-  if (uninstall_url.is_empty())
+  if (uninstall_url.is_empty() || !uninstall_url.SchemeIsHTTPOrHTTPS())

[not at google - send to devlin, 2015/08/10 22:33:02]

Second half of check is enough, and it's worth commenting like:

if (!uninstall_url.SchemeIsHTTPOrHTTPS()) {
  // In previous versions of Chrome non-http[s] URLs were allowed,
  // and may be stored in prefs. Now, they're disallowed, but old data
  // may exist.
  return;
}

     return;
 
   RuntimeAPI::GetFactoryInstance()->Get(context)->OpenURL(uninstall_url);
@@ -448,10 +448,12 @@ ExtensionFunction::ResponseAction RuntimeSetUninstallURLFunction::Run() {
   std::string url_string;
   EXTENSION_FUNCTION_VALIDATE(args_->GetString(0, &url_string));
 
-  GURL url(url_string);
-  if (!url.is_valid()) {
-    return RespondNow(
-        Error(ErrorUtils::FormatErrorMessage(kInvalidUrlError, url_string)));
+  if (!url_string.empty()) {
+    GURL url(url_string);
+    if (!url.is_valid() || !url.SchemeIsHTTPOrHTTPS()) {
+      return RespondNow(
+          Error(ErrorUtils::FormatErrorMessage(kInvalidUrlError, url_string)));
+    }
   }

[not at google - send to devlin, 2015/08/10 22:33:02]

likewise here it could be just

if (!url_string.empty() && !GURL(url_string).SchemeIsHTTPOrHTTPS()) {
  return RespondNow(Error(kInvalidUrlError, url_string));
}


^^^ (yes you can simplify Error(ErrorUtils::FormatErrorMessage(kInvalidUrlError,
url_string)) --> Error(kInvalidUrlError, url_string))

   SetUninstallURL(
       ExtensionPrefs::Get(browser_context()), extension_id(), url_string);