Don't count host permission changes for v2 apps as a permission increase.

chrome/common/extensions/permissions/permission_set.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/permissions/permission_set.h"
 
 #include <algorithm>
 #include <iterator>
 #include <string>
 
@@ skipping 76 matching lines @@
 // Functions will be of the form api_name.function
 // Events will be of the form api_name/id or api_name.optional.stuff
 std::string GetPermissionName(const std::string& function_name) {
   size_t separator = function_name.find_first_of("./");
   if (separator != std::string::npos)
     return function_name.substr(0, separator);
   else
     return function_name;
 }
 
+
+
 }  // namespace
 
 namespace extensions {
 
 //
 // PermissionSet
 //
 
 PermissionSet::PermissionSet() {}
 
@@ skipping 149 matching lines @@
     Manifest::Type extension_type) const {
   PermissionMessages messages;
 
   if (HasEffectiveFullAccess()) {
     messages.push_back(PermissionMessage(
         PermissionMessage::kFullAccess,
         l10n_util::GetStringUTF16(IDS_EXTENSION_PROMPT_WARNING_FULL_ACCESS)));
     return messages;
   }
 
-  // Since platform apps always use isolated storage, they can't (silently)
-  // access user data on other domains, so there's no need to prompt.
-  if (extension_type != Manifest::TYPE_PLATFORM_APP) {
-    if (HasEffectiveAccessToAllHosts()) {
-      messages.push_back(PermissionMessage(
-          PermissionMessage::kHostsAll,
-          l10n_util::GetStringUTF16(IDS_EXTENSION_PROMPT_WARNING_ALL_HOSTS)));
-    } else {
-      for (URLPatternSet::const_iterator i = effective_hosts_.begin();
-           i != effective_hosts_.end(); ++i) {
-        if (i->scheme() != chrome::kChromeUIScheme)
-          continue;
-        // chrome://favicon is the only URL for chrome:// scheme that we
-        // want to support. We want to deprecate the "chrome" scheme.
-        // We should not add any additional "host" here.
-        if (GURL(chrome::kChromeUIFaviconURL).host() != i->host())
-          continue;
-        messages.push_back(PermissionMessage(
-            PermissionMessage::kFavicon,
-            l10n_util::GetStringUTF16(IDS_EXTENSION_PROMPT_WARNING_FAVICON)));
-      }
-      std::set<std::string> hosts = GetDistinctHostsForDisplay();
-      if (!hosts.empty())
-        messages.push_back(PermissionMessage::CreateFromHostList(hosts));
-    }
-  }
-
-  std::set<PermissionMessage> simple_msgs =
-      GetSimplePermissionMessages();
-  messages.insert(messages.end(), simple_msgs.begin(), simple_msgs.end());
+  std::set<PermissionMessage> host_msgs =
+      GetHostPermissionMessages(extension_type);
+  std::set<PermissionMessage> api_msgs = GetAPIPermissionMessages();
+  messages.insert(messages.end(), host_msgs.begin(), host_msgs.end());
+  messages.insert(messages.end(), api_msgs.begin(), api_msgs.end());
 
   return messages;
 }
 
 std::vector<string16> PermissionSet::GetWarningMessages(
     Manifest::Type extension_type) const {
   std::vector<string16> messages;
   PermissionMessages permissions = GetPermissionMessages(extension_type);
 
   bool audio_capture = false;
@@ skipping 131 matching lines @@
 bool PermissionSet::HasEffectiveFullAccess() const {
   for (APIPermissionSet::const_iterator i = apis().begin();
        i != apis().end(); ++i) {
     if (i->info()->implies_full_access())
       return true;
   }
   return false;
 }
 
 bool PermissionSet::HasLessPrivilegesThan(
-    const PermissionSet* permissions) const {
+    const PermissionSet* permissions,
+    Manifest::Type extension_type) const {
   // Things can't get worse than native code access.
   if (HasEffectiveFullAccess())
     return false;
 
   // Otherwise, it's a privilege increase if the new one has full access.
   if (permissions->HasEffectiveFullAccess())
     return true;
 
-  if (HasLessHostPrivilegesThan(permissions))
+  if (HasLessHostPrivilegesThan(permissions, extension_type))
     return true;
 
   if (HasLessAPIPrivilegesThan(permissions))
     return true;
 
   return false;
 }
 
 PermissionSet::~PermissionSet() {}
 
@@ skipping 72 matching lines @@
     apis_.insert(APIPermission::kFileBrowserHandlerInternal);
 }
 
 void PermissionSet::InitEffectiveHosts() {
   effective_hosts_.ClearPatterns();
 
   URLPatternSet::CreateUnion(
       explicit_hosts(), scriptable_hosts(), &effective_hosts_);
 }
 
-std::set<PermissionMessage>
-    PermissionSet::GetSimplePermissionMessages() const {
+std::set<PermissionMessage> PermissionSet::GetAPIPermissionMessages() const {
   std::set<PermissionMessage> messages;
   for (APIPermissionSet::const_iterator permission_it = apis_.begin();
        permission_it != apis_.end(); ++permission_it) {
     DCHECK_GT(PermissionMessage::kNone,
               PermissionMessage::kUnknown);
     if (permission_it->HasMessages()) {
       PermissionMessages new_messages = permission_it->GetMessages();
       messages.insert(new_messages.begin(), new_messages.end());
     }
   }
   return messages;
 }
 
+std::set<PermissionMessage> PermissionSet::GetHostPermissionMessages(
+    Manifest::Type extension_type) const {
+  // Since platform apps always use isolated storage, they can't (silently)
+  // access user data on other domains, so there's no need to prompt.
+  // Note: this must remain consistent with HasLessHostPrivilegesThan.
+  // See crbug.com/255229.
+  std::set<PermissionMessage> messages;
+  if (extension_type == Manifest::TYPE_PLATFORM_APP)
+    return messages;
+
+  if (HasEffectiveAccessToAllHosts()) {
+    messages.insert(PermissionMessage(
+        PermissionMessage::kHostsAll,
+        l10n_util::GetStringUTF16(IDS_EXTENSION_PROMPT_WARNING_ALL_HOSTS)));
+  } else {
+    for (URLPatternSet::const_iterator i = effective_hosts_.begin();
+         i != effective_hosts_.end(); ++i) {
+      if (i->scheme() != chrome::kChromeUIScheme)
+        continue;
+      // chrome://favicon is the only URL for chrome:// scheme that we
+      // want to support. We want to deprecate the "chrome" scheme.
+      // We should not add any additional "host" here.
+      if (GURL(chrome::kChromeUIFaviconURL).host() != i->host())
+        continue;
+      messages.insert(PermissionMessage(
+          PermissionMessage::kFavicon,
+          l10n_util::GetStringUTF16(IDS_EXTENSION_PROMPT_WARNING_FAVICON)));
+    }
+    std::set<std::string> hosts = GetDistinctHostsForDisplay();
+    if (!hosts.empty())
+      messages.insert(PermissionMessage::CreateFromHostList(hosts));
+  }
+  return messages;
+}
+
 bool PermissionSet::HasLessAPIPrivilegesThan(
     const PermissionSet* permissions) const {
   if (permissions == NULL)
     return false;
 
   std::set<PermissionMessage> current_warnings =
-      GetSimplePermissionMessages();
+      GetAPIPermissionMessages();
   std::set<PermissionMessage> new_warnings =
-      permissions->GetSimplePermissionMessages();
+      permissions->GetAPIPermissionMessages();
   std::set<PermissionMessage> delta_warnings;
   std::set_difference(new_warnings.begin(), new_warnings.end(),
                       current_warnings.begin(), current_warnings.end(),
                       std::inserter(delta_warnings, delta_warnings.begin()));
 
   // We have less privileges if there are additional warnings present.
   return !delta_warnings.empty();
 }
 
 bool PermissionSet::HasLessHostPrivilegesThan(
-    const PermissionSet* permissions) const {
+    const PermissionSet* permissions,
+    Manifest::Type extension_type) const {
+  // Platform apps host permission changes do not count as privilege increases.
+  // Note: this must remain consistent with GetHostPermissionMessages.
+  if (extension_type == Manifest::TYPE_PLATFORM_APP)
+    return false;
+
   // If this permission set can access any host, then it can't be elevated.
   if (HasEffectiveAccessToAllHosts())
     return false;
 
   // Likewise, if the other permission set has full host access, then it must be
   // a privilege increase.
   if (permissions->HasEffectiveAccessToAllHosts())
     return true;
 
   const URLPatternSet& old_list = effective_hosts();
   const URLPatternSet& new_list = permissions->effective_hosts();
 
   // TODO(jstritar): This is overly conservative with respect to subdomains.
   // For example, going from *.google.com to www.google.com will be
   // considered an elevation, even though it is not (http://crbug.com/65337).
   std::set<std::string> new_hosts_set(GetDistinctHosts(new_list, false, false));
   std::set<std::string> old_hosts_set(GetDistinctHosts(old_list, false, false));
   std::set<std::string> new_hosts_only;
 
   std::set_difference(new_hosts_set.begin(), new_hosts_set.end(),
                       old_hosts_set.begin(), old_hosts_set.end(),
                       std::inserter(new_hosts_only, new_hosts_only.begin()));
 
   return !new_hosts_only.empty();
 }
 
 }  // namespace extensions