Remove ExtensionURLInfo, make security decisions in render process

chrome/browser/extensions/extension_function_dispatcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_function_dispatcher.h"
 
 #include "base/bind.h"
 #include "base/json/json_string_value_serializer.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
@@ skipping 339 matching lines @@
   ExtensionService* service = profile()->GetExtensionService();
   ExtensionProcessManager* process_manager =
       extensions::ExtensionSystem::Get(profile())->process_manager();
   extensions::ProcessMap* process_map = service->process_map();
   if (!service || !process_map)
     return;
 
   const Extension* extension = service->extensions()->GetByID(
       params.extension_id);
   if (!extension)
-    extension = service->extensions()->GetHostedAppByURL(ExtensionURLInfo(
-        WebSecurityOrigin::createFromString(params.source_origin),

[abarth-chromium, 2013/06/10 23:12:32]

Should we check source_origin here?

[jamesr, 2013/06/10 23:36:46]

Yes. In particular, if the source_origin is unique this check should fail - but
that appears to be the only use of the source_origin IPC parameter.  We could
replace it with a bool or, since all checks will fail on a call from a unique
origin, make the source_url be an empty/invalid GURL when the source origin is
unique

[jamesr, 2013/07/10 20:38:58]

Actually, this will be the string "null" if the origin is unique. This field is
populated here:

https://code.google.com/p/chromium/codesearch#chromium/src/chrome/renderer/ex...

and toString() on a unique WebSecurityOrigin is defined to return "null", so
this'll never match for a unique origin.  So this code is fine as is.

[jamesr, 2013/07/10 20:39:55]

Sorry, the source_origin will be "null", so we can just check that.

-        params.source_url));
+    extension = service->extensions()->GetHostedAppByURL(params.source_url);
 
   scoped_refptr<ExtensionFunction> function(
       CreateExtensionFunction(params, extension,
                               render_view_host->GetProcess()->GetID(),
                               *(service->process_map()),
                               extensions::ExtensionAPI::GetSharedInstance(),
                               profile(), callback));
   scoped_ptr<ListValue> args(params.arguments.DeepCopy());
 
   if (!function.get()) {
@@ skipping 159 matching lines @@
   return function;
 }
 
 // static
 void ExtensionFunctionDispatcher::SendAccessDenied(
     const ExtensionFunction::ResponseCallback& callback) {
   ListValue empty_list;
   callback.Run(ExtensionFunction::FAILED, empty_list,
                "Access to extension API denied.");
 }