OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/common/extensions/permissions/chrome_permission_message_provide
r.h" | 5 #include "chrome/common/extensions/permissions/chrome_permission_message_provide
r.h" |
6 | 6 |
7 #include "base/stl_util.h" | 7 #include "base/stl_util.h" |
8 #include "base/strings/stringprintf.h" | 8 #include "base/strings/stringprintf.h" |
9 #include "extensions/common/extensions_client.h" | 9 #include "extensions/common/extensions_client.h" |
10 #include "extensions/common/permissions/permission_message.h" | 10 #include "extensions/common/permissions/permission_message.h" |
11 #include "extensions/common/permissions/permission_message_util.h" | 11 #include "extensions/common/permissions/permission_message_util.h" |
12 #include "extensions/common/permissions/permission_set.h" | 12 #include "extensions/common/permissions/permission_set.h" |
13 #include "extensions/common/url_pattern.h" | 13 #include "extensions/common/url_pattern.h" |
14 #include "extensions/common/url_pattern_set.h" | 14 #include "extensions/common/url_pattern_set.h" |
15 #include "grit/generated_resources.h" | 15 #include "grit/generated_resources.h" |
16 #include "net/base/registry_controlled_domains/registry_controlled_domain.h" | 16 #include "net/base/registry_controlled_domains/registry_controlled_domain.h" |
17 #include "ui/base/l10n/l10n_util.h" | 17 #include "ui/base/l10n/l10n_util.h" |
18 #include "url/gurl.h" | 18 #include "url/gurl.h" |
19 | 19 |
20 namespace extensions { | 20 namespace extensions { |
21 | 21 |
22 namespace { | 22 namespace { |
23 | 23 |
| 24 typedef std::set<PermissionMessage> PermissionMsgSet; |
| 25 |
24 bool ShouldWarnAllHosts(const PermissionSet* permissions) { | 26 bool ShouldWarnAllHosts(const PermissionSet* permissions) { |
25 if (permissions->HasEffectiveAccessToAllHosts()) | 27 if (permissions->HasEffectiveAccessToAllHosts()) |
26 return true; | 28 return true; |
27 | 29 |
28 const URLPatternSet& effective_hosts = permissions->effective_hosts(); | 30 const URLPatternSet& effective_hosts = permissions->effective_hosts(); |
29 for (URLPatternSet::const_iterator iter = effective_hosts.begin(); | 31 for (URLPatternSet::const_iterator iter = effective_hosts.begin(); |
30 iter != effective_hosts.end(); | 32 iter != effective_hosts.end(); |
31 ++iter) { | 33 ++iter) { |
32 // If this doesn't even match subdomains, it can't possibly imply all hosts. | 34 // If this doesn't even match subdomains, it can't possibly imply all hosts. |
33 if (!iter->match_subdomains()) | 35 if (!iter->match_subdomains()) |
(...skipping 21 matching lines...) Expand all Loading... |
55 net::registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES); | 57 net::registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES); |
56 // If we recognized this TLD, then this is a pattern like *.com, and it | 58 // If we recognized this TLD, then this is a pattern like *.com, and it |
57 // should imply all hosts. | 59 // should imply all hosts. |
58 if (registry_length > 0) | 60 if (registry_length > 0) |
59 return true; | 61 return true; |
60 } | 62 } |
61 | 63 |
62 return false; | 64 return false; |
63 } | 65 } |
64 | 66 |
65 PermissionMessages::iterator FindMessageByID(PermissionMessages& messages, | 67 template<typename T> |
66 int id) { | 68 typename T::iterator FindMessageByID(T& messages, int id) { |
67 for (PermissionMessages::iterator it = messages.begin(); | 69 for (typename T::iterator it = messages.begin(); |
68 it != messages.end(); ++it) { | 70 it != messages.end(); ++it) { |
69 if (it->id() == id) | 71 if (it->id() == id) |
70 return it; | 72 return it; |
71 } | 73 } |
| 74 return messages.end(); |
| 75 } |
72 | 76 |
73 return messages.end(); | 77 template<typename T> |
| 78 void SuppressMessage(T& messages, |
| 79 int suppressing_message, |
| 80 int suppressed_message) { |
| 81 typename T::iterator suppressed = FindMessageByID(messages, |
| 82 suppressed_message); |
| 83 if (suppressed != messages.end() && |
| 84 FindMessageByID(messages, suppressing_message) != messages.end()) { |
| 85 messages.erase(suppressed); |
| 86 } |
74 } | 87 } |
75 | 88 |
76 } // namespace | 89 } // namespace |
77 | 90 |
78 ChromePermissionMessageProvider::ChromePermissionMessageProvider() { | 91 ChromePermissionMessageProvider::ChromePermissionMessageProvider() { |
79 } | 92 } |
80 | 93 |
81 ChromePermissionMessageProvider::~ChromePermissionMessageProvider() { | 94 ChromePermissionMessageProvider::~ChromePermissionMessageProvider() { |
82 } | 95 } |
83 | 96 |
84 // static | 97 // static |
85 PermissionMessages ChromePermissionMessageProvider::GetPermissionMessages( | 98 PermissionMessages ChromePermissionMessageProvider::GetPermissionMessages( |
86 const PermissionSet* permissions, | 99 const PermissionSet* permissions, |
87 Manifest::Type extension_type) const { | 100 Manifest::Type extension_type) const { |
88 PermissionMessages messages; | 101 PermissionMessages messages; |
89 | 102 |
90 if (permissions->HasEffectiveFullAccess()) { | 103 if (permissions->HasEffectiveFullAccess()) { |
91 messages.push_back(PermissionMessage( | 104 messages.push_back(PermissionMessage( |
92 PermissionMessage::kFullAccess, | 105 PermissionMessage::kFullAccess, |
93 l10n_util::GetStringUTF16(IDS_EXTENSION_PROMPT_WARNING_FULL_ACCESS))); | 106 l10n_util::GetStringUTF16(IDS_EXTENSION_PROMPT_WARNING_FULL_ACCESS))); |
94 return messages; | 107 return messages; |
95 } | 108 } |
96 | 109 |
97 std::set<PermissionMessage> host_msgs = | 110 PermissionMsgSet host_msgs = |
98 GetHostPermissionMessages(permissions, extension_type); | 111 GetHostPermissionMessages(permissions, extension_type); |
99 std::set<PermissionMessage> api_msgs = GetAPIPermissionMessages(permissions); | 112 PermissionMsgSet api_msgs = GetAPIPermissionMessages(permissions); |
100 std::set<PermissionMessage> manifest_permission_msgs = | 113 PermissionMsgSet manifest_permission_msgs = |
101 GetManifestPermissionMessages(permissions); | 114 GetManifestPermissionMessages(permissions); |
102 messages.insert(messages.end(), host_msgs.begin(), host_msgs.end()); | 115 messages.insert(messages.end(), host_msgs.begin(), host_msgs.end()); |
103 messages.insert(messages.end(), api_msgs.begin(), api_msgs.end()); | 116 messages.insert(messages.end(), api_msgs.begin(), api_msgs.end()); |
104 messages.insert(messages.end(), manifest_permission_msgs.begin(), | 117 messages.insert(messages.end(), manifest_permission_msgs.begin(), |
105 manifest_permission_msgs.end()); | 118 manifest_permission_msgs.end()); |
106 | 119 |
107 // Special hack: bookmarks permission message supersedes override bookmarks UI | 120 // Some warnings are more generic and/or powerful and superseed other |
108 // permission message if both permissions are specified. | 121 // warnings. In that case, suppress the superseeded warning. |
109 PermissionMessages::iterator override_bookmarks_ui = | 122 SuppressMessage(messages, |
110 FindMessageByID(messages, PermissionMessage::kOverrideBookmarksUI); | 123 PermissionMessage::kBookmarks, |
111 if (override_bookmarks_ui != messages.end() && | 124 PermissionMessage::kOverrideBookmarksUI); |
112 FindMessageByID(messages, PermissionMessage::kBookmarks) != | 125 SuppressMessage(messages, |
113 messages.end()) { | 126 PermissionMessage::kBrowsingHistory, |
114 messages.erase(override_bookmarks_ui); | 127 PermissionMessage::kTabs); |
115 } | |
116 | |
117 return messages; | 128 return messages; |
118 } | 129 } |
119 | 130 |
120 // static | 131 // static |
121 std::vector<base::string16> ChromePermissionMessageProvider::GetWarningMessages( | 132 std::vector<base::string16> ChromePermissionMessageProvider::GetWarningMessages( |
122 const PermissionSet* permissions, | 133 const PermissionSet* permissions, |
123 Manifest::Type extension_type) const { | 134 Manifest::Type extension_type) const { |
124 std::vector<base::string16> message_strings; | 135 std::vector<base::string16> message_strings; |
125 PermissionMessages messages = | 136 PermissionMessages messages = |
126 GetPermissionMessages(permissions, extension_type); | 137 GetPermissionMessages(permissions, extension_type); |
(...skipping 97 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
224 | 235 |
225 if (IsManifestPermissionPrivilegeIncrease(old_permissions, new_permissions)) | 236 if (IsManifestPermissionPrivilegeIncrease(old_permissions, new_permissions)) |
226 return true; | 237 return true; |
227 | 238 |
228 return false; | 239 return false; |
229 } | 240 } |
230 | 241 |
231 std::set<PermissionMessage> | 242 std::set<PermissionMessage> |
232 ChromePermissionMessageProvider::GetAPIPermissionMessages( | 243 ChromePermissionMessageProvider::GetAPIPermissionMessages( |
233 const PermissionSet* permissions) const { | 244 const PermissionSet* permissions) const { |
234 std::set<PermissionMessage> messages; | 245 PermissionMsgSet messages; |
235 for (APIPermissionSet::const_iterator permission_it = | 246 for (APIPermissionSet::const_iterator permission_it = |
236 permissions->apis().begin(); | 247 permissions->apis().begin(); |
237 permission_it != permissions->apis().end(); ++permission_it) { | 248 permission_it != permissions->apis().end(); ++permission_it) { |
238 if (permission_it->HasMessages()) { | 249 if (permission_it->HasMessages()) { |
239 PermissionMessages new_messages = permission_it->GetMessages(); | 250 PermissionMessages new_messages = permission_it->GetMessages(); |
240 messages.insert(new_messages.begin(), new_messages.end()); | 251 messages.insert(new_messages.begin(), new_messages.end()); |
241 } | 252 } |
242 } | 253 } |
243 | 254 |
244 // A special hack: If kFileSystemWriteDirectory would be displayed, hide | 255 // A special hack: If kFileSystemWriteDirectory would be displayed, hide |
245 // kFileSystemDirectory and and kFileSystemWrite as the write directory | 256 // kFileSystemDirectory and and kFileSystemWrite as the write directory |
246 // message implies the other two. | 257 // message implies the other two. |
247 // TODO(sammc): Remove this. See http://crbug.com/284849. | 258 // TODO(sammc): Remove this. See http://crbug.com/284849. |
248 std::set<PermissionMessage>::iterator write_directory_message = | 259 SuppressMessage(messages, |
249 messages.find(PermissionMessage( | 260 PermissionMessage::kFileSystemWriteDirectory, |
250 PermissionMessage::kFileSystemWriteDirectory, base::string16())); | 261 PermissionMessage::kFileSystemWrite); |
251 if (write_directory_message != messages.end()) { | 262 SuppressMessage(messages, |
252 messages.erase( | 263 PermissionMessage::kFileSystemWriteDirectory, |
253 PermissionMessage(PermissionMessage::kFileSystemWrite, | 264 PermissionMessage::kFileSystemDirectory); |
254 base::string16())); | |
255 messages.erase( | |
256 PermissionMessage(PermissionMessage::kFileSystemDirectory, | |
257 base::string16())); | |
258 } | |
259 | |
260 // A special hack: The warning message for declarativeWebRequest | 265 // A special hack: The warning message for declarativeWebRequest |
261 // permissions speaks about blocking parts of pages, which is a | 266 // permissions speaks about blocking parts of pages, which is a |
262 // subset of what the "<all_urls>" access allows. Therefore we | 267 // subset of what the "<all_urls>" access allows. Therefore we |
263 // display only the "<all_urls>" warning message if both permissions | 268 // display only the "<all_urls>" warning message if both permissions |
264 // are required. | 269 // are required. |
265 if (ShouldWarnAllHosts(permissions)) { | 270 if (ShouldWarnAllHosts(permissions)) { |
266 messages.erase( | 271 messages.erase( |
267 PermissionMessage( | 272 PermissionMessage( |
268 PermissionMessage::kDeclarativeWebRequest, base::string16())); | 273 PermissionMessage::kDeclarativeWebRequest, base::string16())); |
269 } | 274 } |
270 | |
271 return messages; | 275 return messages; |
272 } | 276 } |
273 | 277 |
274 std::set<PermissionMessage> | 278 std::set<PermissionMessage> |
275 ChromePermissionMessageProvider::GetManifestPermissionMessages( | 279 ChromePermissionMessageProvider::GetManifestPermissionMessages( |
276 const PermissionSet* permissions) const { | 280 const PermissionSet* permissions) const { |
277 std::set<PermissionMessage> messages; | 281 PermissionMsgSet messages; |
278 for (ManifestPermissionSet::const_iterator permission_it = | 282 for (ManifestPermissionSet::const_iterator permission_it = |
279 permissions->manifest_permissions().begin(); | 283 permissions->manifest_permissions().begin(); |
280 permission_it != permissions->manifest_permissions().end(); | 284 permission_it != permissions->manifest_permissions().end(); |
281 ++permission_it) { | 285 ++permission_it) { |
282 if (permission_it->HasMessages()) { | 286 if (permission_it->HasMessages()) { |
283 PermissionMessages new_messages = permission_it->GetMessages(); | 287 PermissionMessages new_messages = permission_it->GetMessages(); |
284 messages.insert(new_messages.begin(), new_messages.end()); | 288 messages.insert(new_messages.begin(), new_messages.end()); |
285 } | 289 } |
286 } | 290 } |
287 return messages; | 291 return messages; |
288 } | 292 } |
289 | 293 |
290 std::set<PermissionMessage> | 294 std::set<PermissionMessage> |
291 ChromePermissionMessageProvider::GetHostPermissionMessages( | 295 ChromePermissionMessageProvider::GetHostPermissionMessages( |
292 const PermissionSet* permissions, | 296 const PermissionSet* permissions, |
293 Manifest::Type extension_type) const { | 297 Manifest::Type extension_type) const { |
294 std::set<PermissionMessage> messages; | 298 PermissionMsgSet messages; |
295 // Since platform apps always use isolated storage, they can't (silently) | 299 // Since platform apps always use isolated storage, they can't (silently) |
296 // access user data on other domains, so there's no need to prompt. | 300 // access user data on other domains, so there's no need to prompt. |
297 // Note: this must remain consistent with IsHostPrivilegeIncrease. | 301 // Note: this must remain consistent with IsHostPrivilegeIncrease. |
298 // See crbug.com/255229. | 302 // See crbug.com/255229. |
299 if (extension_type == Manifest::TYPE_PLATFORM_APP) | 303 if (extension_type == Manifest::TYPE_PLATFORM_APP) |
300 return messages; | 304 return messages; |
301 | 305 |
302 if (ShouldWarnAllHosts(permissions)) { | 306 if (ShouldWarnAllHosts(permissions)) { |
303 messages.insert(PermissionMessage( | 307 messages.insert(PermissionMessage( |
304 PermissionMessage::kHostsAll, | 308 PermissionMessage::kHostsAll, |
(...skipping 10 matching lines...) Expand all Loading... |
315 } | 319 } |
316 return messages; | 320 return messages; |
317 } | 321 } |
318 | 322 |
319 bool ChromePermissionMessageProvider::IsAPIPrivilegeIncrease( | 323 bool ChromePermissionMessageProvider::IsAPIPrivilegeIncrease( |
320 const PermissionSet* old_permissions, | 324 const PermissionSet* old_permissions, |
321 const PermissionSet* new_permissions) const { | 325 const PermissionSet* new_permissions) const { |
322 if (new_permissions == NULL) | 326 if (new_permissions == NULL) |
323 return false; | 327 return false; |
324 | 328 |
325 typedef std::set<PermissionMessage> PermissionMsgSet; | |
326 PermissionMsgSet old_warnings = GetAPIPermissionMessages(old_permissions); | 329 PermissionMsgSet old_warnings = GetAPIPermissionMessages(old_permissions); |
327 PermissionMsgSet new_warnings = GetAPIPermissionMessages(new_permissions); | 330 PermissionMsgSet new_warnings = GetAPIPermissionMessages(new_permissions); |
328 PermissionMsgSet delta_warnings = | 331 PermissionMsgSet delta_warnings = |
329 base::STLSetDifference<PermissionMsgSet>(new_warnings, old_warnings); | 332 base::STLSetDifference<PermissionMsgSet>(new_warnings, old_warnings); |
330 | 333 |
331 // A special hack: kFileSystemWriteDirectory implies kFileSystemDirectory and | 334 // A special hack: kFileSystemWriteDirectory implies kFileSystemDirectory and |
332 // kFileSystemWrite. | 335 // kFileSystemWrite. |
333 // TODO(sammc): Remove this. See http://crbug.com/284849. | 336 // TODO(sammc): Remove this. See http://crbug.com/284849. |
334 if (old_warnings.find(PermissionMessage( | 337 if (old_warnings.find(PermissionMessage( |
335 PermissionMessage::kFileSystemWriteDirectory, base::string16())) != | 338 PermissionMessage::kFileSystemWriteDirectory, base::string16())) != |
336 old_warnings.end()) { | 339 old_warnings.end()) { |
337 delta_warnings.erase( | 340 delta_warnings.erase( |
338 PermissionMessage(PermissionMessage::kFileSystemDirectory, | 341 PermissionMessage(PermissionMessage::kFileSystemDirectory, |
339 base::string16())); | 342 base::string16())); |
340 delta_warnings.erase( | 343 delta_warnings.erase( |
341 PermissionMessage(PermissionMessage::kFileSystemWrite, | 344 PermissionMessage(PermissionMessage::kFileSystemWrite, |
342 base::string16())); | 345 base::string16())); |
343 } | 346 } |
344 | 347 |
345 // It is a privilege increase if there are additional warnings present. | 348 // It is a privilege increase if there are additional warnings present. |
346 return !delta_warnings.empty(); | 349 return !delta_warnings.empty(); |
347 } | 350 } |
348 | 351 |
349 bool ChromePermissionMessageProvider::IsManifestPermissionPrivilegeIncrease( | 352 bool ChromePermissionMessageProvider::IsManifestPermissionPrivilegeIncrease( |
350 const PermissionSet* old_permissions, | 353 const PermissionSet* old_permissions, |
351 const PermissionSet* new_permissions) const { | 354 const PermissionSet* new_permissions) const { |
352 if (new_permissions == NULL) | 355 if (new_permissions == NULL) |
353 return false; | 356 return false; |
354 | 357 |
355 typedef std::set<PermissionMessage> PermissionMsgSet; | |
356 PermissionMsgSet old_warnings = | 358 PermissionMsgSet old_warnings = |
357 GetManifestPermissionMessages(old_permissions); | 359 GetManifestPermissionMessages(old_permissions); |
358 PermissionMsgSet new_warnings = | 360 PermissionMsgSet new_warnings = |
359 GetManifestPermissionMessages(new_permissions); | 361 GetManifestPermissionMessages(new_permissions); |
360 PermissionMsgSet delta_warnings = | 362 PermissionMsgSet delta_warnings = |
361 base::STLSetDifference<PermissionMsgSet>(new_warnings, old_warnings); | 363 base::STLSetDifference<PermissionMsgSet>(new_warnings, old_warnings); |
362 | 364 |
363 // It is a privilege increase if there are additional warnings present. | 365 // It is a privilege increase if there are additional warnings present. |
364 return !delta_warnings.empty(); | 366 return !delta_warnings.empty(); |
365 } | 367 } |
(...skipping 27 matching lines...) Expand all Loading... |
393 std::set<std::string> old_hosts_set( | 395 std::set<std::string> old_hosts_set( |
394 permission_message_util::GetDistinctHosts(old_list, false, false)); | 396 permission_message_util::GetDistinctHosts(old_list, false, false)); |
395 std::set<std::string> new_hosts_only = | 397 std::set<std::string> new_hosts_only = |
396 base::STLSetDifference<std::set<std::string> >(new_hosts_set, | 398 base::STLSetDifference<std::set<std::string> >(new_hosts_set, |
397 old_hosts_set); | 399 old_hosts_set); |
398 | 400 |
399 return !new_hosts_only.empty(); | 401 return !new_hosts_only.empty(); |
400 } | 402 } |
401 | 403 |
402 } // namespace extensions | 404 } // namespace extensions |
OLD | NEW |