[extensions] Remove unnecessary checks in IsSensitiveURL

extensions/browser/api/web_request/web_request_permissions.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/web_request/web_request_permissions.h"
 
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "content/public/browser/resource_request_info.h"
 #include "extensions/browser/extension_navigation_ui_data.h"
@@ skipping 12 matching lines @@
 
 namespace {
 
 // Returns true if the URL is sensitive and requests to this URL must not be
 // modified/canceled by extensions, e.g. because it is targeted to the webstore
 // to check for updates, extension blacklisting, etc.
 bool IsSensitiveURL(const GURL& url) {
   // TODO(battre) Merge this, CanExtensionAccessURL and
   // PermissionsData::CanAccessPage into one function.
   bool sensitive_chrome_url = false;
   const std::string host = url.host();

[Devlin, 2016/11/10 20:57:15]

can this be a StringPiece?

   const char kGoogleCom[] = ".google.com";
   const char kClient[] = "clients";
   if (base::EndsWith(host, kGoogleCom, base::CompareCase::SENSITIVE)) {

[Devlin, 2016/11/10 20:57:14]

Can we use url.DomainIs(kGoogleCom)?  I know it would work for
DomainIs("google.com"), and I *think* it does for ".google.com", but it'd be
worth double-checking.

[Charlie Harrison, 2016/11/10 22:10:20]

I think we should just make kGoogleCom = "google.com"

     // Check for "clients[0-9]*.google.com" hosts.
     // This protects requests to several internal services such as sync,
     // extension update pings, captive portal detection, fraudulent certificate
     // reporting, autofill and others.
     if (base::StartsWith(host, kClient, base::CompareCase::SENSITIVE)) {
       bool match = true;
       for (std::string::const_iterator i = host.begin() + strlen(kClient),
                end = host.end() - strlen(kGoogleCom); i != end; ++i) {
         if (!isdigit(*i)) {
           match = false;
           break;
         }
       }
       sensitive_chrome_url = sensitive_chrome_url || match;
     }
     // This protects requests to safe browsing, link doctor, and possibly
     // others.
     sensitive_chrome_url =
         sensitive_chrome_url ||
         base::EndsWith(url.host(), ".clients.google.com",

[Devlin, 2016/11/10 20:57:15]

ditto, DomainIs?

[Charlie Harrison, 2016/11/10 22:10:20]

Done.

                        base::CompareCase::SENSITIVE) ||
         url.host() == "sb-ssl.google.com" ||

[Devlin, 2016/11/10 20:57:15]

host_piece() here and below

[Charlie Harrison, 2016/11/10 22:10:20]

Done.

         (url.host() == "chrome.google.com" &&
          base::StartsWith(url.path(), "/webstore",
                           base::CompareCase::SENSITIVE));
   }
-  GURL::Replacements replacements;
-  replacements.ClearQuery();
-  replacements.ClearRef();
-  GURL url_without_query = url.ReplaceComponents(replacements);
-  return sensitive_chrome_url ||
-      extension_urls::IsWebstoreUpdateUrl(url_without_query) ||
-      extension_urls::IsBlacklistUpdateUrl(url);
+  return sensitive_chrome_url || extension_urls::IsWebstoreUpdateUrl(url) ||
+         extension_urls::IsBlacklistUpdateUrl(url);
 }
 
 // Returns true if the scheme is one we want to allow extensions to have access
 // to. Extensions still need specific permissions for a given URL, which is
 // covered by CanExtensionAccessURL.
 bool HasWebRequestScheme(const GURL& url) {
   return (url.SchemeIs(url::kAboutScheme) || url.SchemeIs(url::kFileScheme) ||
           url.SchemeIs(url::kFileSystemScheme) ||
           url.SchemeIs(url::kFtpScheme) || url.SchemeIs(url::kHttpScheme) ||
           url.SchemeIs(url::kHttpsScheme) ||
@@ skipping 67 matching lines @@
       break;
     case REQUIRE_ALL_URLS:
       if (extension->permissions_data()->HasEffectiveAccessToAllHosts())
         access = PermissionsData::ACCESS_ALLOWED;
       // else ACCESS_DENIED
       break;
   }
 
   return access;
 }