Protocol handler dialogs should only be enabled by browser or page actions [Not committed]

chrome/browser/extensions/api/extension_action/extension_action_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/extension_action/extension_action_api.h"
 
 #include "base/base64.h"
 #include "base/lazy_instance.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/values.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/extensions/api/extension_action/extension_page_actions_api_constants.h"
 #include "chrome/browser/extensions/extension_action.h"
 #include "chrome/browser/extensions/extension_action_manager.h"
 #include "chrome/browser/extensions/extension_function_registry.h"
 #include "chrome/browser/extensions/extension_host.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/extension_system.h"
 #include "chrome/browser/extensions/extension_tab_util.h"
 #include "chrome/browser/extensions/extension_toolbar_model.h"
 #include "chrome/browser/extensions/location_bar_controller.h"
 #include "chrome/browser/extensions/state_store.h"
 #include "chrome/browser/extensions/tab_helper.h"
+#include "chrome/browser/external_protocol/external_protocol_handler.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/extensions/api/extension_action/action_info.h"
 #include "chrome/common/render_messages.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/notification_service.h"
 #include "extensions/browser/event_router.h"
 #include "extensions/common/error_utils.h"
 #include "ui/gfx/codec/png_codec.h"
 #include "ui/gfx/image/image.h"
 #include "ui/gfx/image/image_skia.h"
@@ skipping 312 matching lines @@
     case ActionInfo::TYPE_BROWSER:
       event_name = "browserAction.onClicked";
       break;
     case ActionInfo::TYPE_PAGE:
       event_name = "pageAction.onClicked";
       break;
     case ActionInfo::TYPE_SYSTEM_INDICATOR:
       // The System Indicator handles its own clicks.
       break;
   }
-
+  // Browser and page actions should enable launching external protocol
+  // handlers in the absence of any other user gesture.
+  ExternalProtocolHandler::PermitLaunchUrl();

[Jeffrey Yasskin, 2014/01/28 00:54:19]

The other place I'd expect people to be relying on a user gesture being
available is in postMessage()s to their extensions. The bottleneck for that in
the browser process looks like MessageService::DispatchMessage() at
https://code.google.com/p/chromium/codesearch/#chromium/src/chrome/browser/ex...,
where you'd check for message.user_gesture. If you can enable this
renderer-side, you can also use  MessagingBindings::DeliverMessage
(https://code.google.com/p/chromium/codesearch/#chromium/src/chrome/renderer/e...).
It's also possible that postMessage already enables external protocol handlers,
since it does get a Blink-side WebScopedUserGesture.

Context menus might also need this: MenuManager::ExecuteCommand at
https://code.google.com/p/chromium/codesearch/#chromium/src/chrome/browser/ex...

[meacer, 2014/01/30 00:20:44]

Just to clarify: If postMessage wasn't called from within a user gesture, it
shouldn't enable protocol handlers, right? Or do you mean developers would
expect postMessage to enable handlers even without a user gesture?
Looks like it doesn't already enable, the WebScopedUserGesture is created in
that method if message.user_gesture is true.
I'll add the enable code into ActiveTabPermissionGranter::GrantIfRequested as it
looks like it's only invoked by user actions. Should cover
MenuManager::ExecuteCommand as well.

   if (event_name) {
     scoped_ptr<base::ListValue> args(new base::ListValue());
     base::DictionaryValue* tab_value =
         extensions::ExtensionTabUtil::CreateTabValue(web_contents);
     args->Append(tab_value);
 
     DispatchEventToExtension(profile,
                              extension_action.extension_id(),
                              event_name,
                              args.Pass());
@@ skipping 552 matching lines @@
   return true;
 }
 
 bool EnablePageActionsFunction::RunImpl() {
   return SetPageActionEnabled(true);
 }
 
 bool DisablePageActionsFunction::RunImpl() {
   return SetPageActionEnabled(false);
 }