Don't count host permission changes for v2 apps as a permission increase.

chrome/common/extensions/permissions/permission_set.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/permissions/permission_set.h"
 
 #include <algorithm>
 #include <iterator>
 #include <string>
 
@@ skipping 426 matching lines @@
 bool PermissionSet::HasEffectiveFullAccess() const {
   for (APIPermissionSet::const_iterator i = apis().begin();
        i != apis().end(); ++i) {
     if (i->info()->implies_full_access())
       return true;
   }
   return false;
 }
 
 bool PermissionSet::HasLessPrivilegesThan(
-    const PermissionSet* permissions) const {
+    const PermissionSet* permissions,
+    Manifest::Type extension_type) const {
   // Things can't get worse than native code access.
   if (HasEffectiveFullAccess())
     return false;
 
   // Otherwise, it's a privilege increase if the new one has full access.
   if (permissions->HasEffectiveFullAccess())
     return true;
 
-  if (HasLessHostPrivilegesThan(permissions))
+  if (HasLessHostPrivilegesThan(permissions, extension_type))
     return true;
 
   if (HasLessAPIPrivilegesThan(permissions))

[Jeffrey Yasskin, 2013/07/09 00:32:57]

Mike, are there other API privileges that we display for Extensions but not
Apps?

[miket_OOO, 2013/07/09 17:12:08]

None come to mind. I ran through chrome_api_permissions.cc, permission_set.cc,
permission_set_unittest.cc, and _permission_features.json.

     return true;
 
   return false;
 }
 
 PermissionSet::~PermissionSet() {}
 
 // static
 std::set<std::string> PermissionSet::GetDistinctHosts(
     const URLPatternSet& host_patterns,
@@ skipping 103 matching lines @@
   std::set<PermissionMessage> delta_warnings;
   std::set_difference(new_warnings.begin(), new_warnings.end(),
                       current_warnings.begin(), current_warnings.end(),
                       std::inserter(delta_warnings, delta_warnings.begin()));
 
   // We have less privileges if there are additional warnings present.
   return !delta_warnings.empty();
 }
 
 bool PermissionSet::HasLessHostPrivilegesThan(
-    const PermissionSet* permissions) const {
+    const PermissionSet* permissions,
+    Manifest::Type extension_type) const {
+  // Platform apps host permission changes do not count as privilege increases.
+  if (extension_type == Manifest::TYPE_PLATFORM_APP)
+    return false;
+
   // If this permission set can access any host, then it can't be elevated.
   if (HasEffectiveAccessToAllHosts())
     return false;
 
   // Likewise, if the other permission set has full host access, then it must be
   // a privilege increase.
   if (permissions->HasEffectiveAccessToAllHosts())
     return true;
 
   const URLPatternSet& old_list = effective_hosts();
   const URLPatternSet& new_list = permissions->effective_hosts();
 
   // TODO(jstritar): This is overly conservative with respect to subdomains.
   // For example, going from *.google.com to www.google.com will be
   // considered an elevation, even though it is not (http://crbug.com/65337).
   std::set<std::string> new_hosts_set(GetDistinctHosts(new_list, false, false));
   std::set<std::string> old_hosts_set(GetDistinctHosts(old_list, false, false));
   std::set<std::string> new_hosts_only;
 
   std::set_difference(new_hosts_set.begin(), new_hosts_set.end(),
                       old_hosts_set.begin(), old_hosts_set.end(),
                       std::inserter(new_hosts_only, new_hosts_only.begin()));
 
   return !new_hosts_only.empty();
 }
 
 }  // namespace extensions