chrome.webRequest support for ExtensionSettings

extensions/browser/api/web_request/web_request_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/web_request/web_request_api.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <memory>
@@ skipping 1481 matching lines @@
         std::find(types.begin(), types.end(), resource_type) == types.end()) {
       continue;
     }
 
     if (!is_web_view_guest) {
       PermissionsData::AccessType access =
           WebRequestPermissions::CanExtensionAccessURL(
               extension_info_map, listener->id.extension_id, url,
               frame_data.tab_id, crosses_incognito,
               WebRequestPermissions::REQUIRE_HOST_PERMISSION);
+
+      // Check if URL blocked from view/modification by policy (URL || Origin).
+      if (extension_info_map) {
+        const extensions::Extension* extension =
+            extension_info_map->extensions().GetByID(listener->id.extension_id);
+        if (extension->permissions_data()->IsRuntimeBlockedHost(url))

[Devlin, 2017/05/15 20:54:51]

Why do we need this?  WebRequestPermissions::CanExtensionAccessURL() checks
PermissionsData::CanRunOnPage(), which is where we put the check for
IsRuntimeBlockedHost().

[nrpeter, 2017/05/15 22:44:43]

IIUC, if you want to redirect a web request, the extension needs permission for
the host being redirected, but not for the origin.

I only want to verify that the extension has permissions for the origin when
using my policy. If we call WebRequestPermissions::CanExtensionAccessURL() on
the origin, then we're changing the behavior of WebRequests API regardless of
whether my policy is being applied. I don't think we'd want to do that.

As you mentioned since IsRuntimeBlockedHost is called as part of
WebRequestPermissions::CanExtensionAccessURL() I just need to check the origin.
This means I can remove the check for IsRuntimeBlockedHost(url). 

+          access = PermissionsData::ACCESS_WITHHELD;

[Devlin, 2017/05/15 20:54:51]

We would want DENIED, right?  WITHHELD will surface this to the user.

[nrpeter, 2017/05/15 22:44:43]

Done.

+        else if (extension->permissions_data()->IsRuntimeBlockedHost(
+                     request->first_party_for_cookies()))
+          access = PermissionsData::ACCESS_WITHHELD;
+      }
+
       if (access != PermissionsData::ACCESS_ALLOWED) {
         if (access == PermissionsData::ACCESS_WITHHELD &&
             web_request_event_router_delegate_) {
           web_request_event_router_delegate_->NotifyWebRequestWithheld(
               render_process_id, render_frame_id, listener->id.extension_id);
         }
         continue;
       }
     }
 
@@ skipping 932 matching lines @@
   // Since EventListeners are segmented by browser_context, check that
   // last, as it is exceedingly unlikely to be different.
   return extension_id == that.extension_id &&
          sub_event_name == that.sub_event_name &&
          web_view_instance_id == that.web_view_instance_id &&
          embedder_process_id == that.embedder_process_id &&
          browser_context == that.browser_context;
 }
 
 }  // namespace extensions