Communicate ExtensionSettings policy to renderers

chrome/browser/extensions/extension_service.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_service.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <iterator>
@@ skipping 848 matching lines @@
 
 void ExtensionService::EnableExtension(const std::string& extension_id) {
   CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   if (IsExtensionEnabled(extension_id) ||
       extension_prefs_->IsExtensionBlacklisted(extension_id))
     return;
   const Extension* extension =
       registry_->disabled_extensions().GetByID(extension_id);
 
+  extensions::ExtensionManagement* management =
+      extensions::ExtensionManagementFactory::GetForBrowserContext(profile());
+
   ManagementPolicy* policy = system_->management_policy();
   if (extension && policy->MustRemainDisabled(extension, nullptr, nullptr)) {
     UMA_HISTOGRAM_COUNTS_100("Extensions.EnableDeniedByPolicy", 1);
     return;
   }
 
+  extensions::PermissionsUpdater(profile()).SetRuntimeBlockedAllowedHosts(
+    extension, management->GetRuntimeBlockedHosts(extension),
+    management->GetRuntimeAllowedHosts(extension));
+
   extension_prefs_->SetExtensionEnabled(extension_id);
 
   // This can happen if sync enables an extension that is not installed yet.
   if (!extension)
     return;
 
   // Move it over to the enabled list.
   registry_->AddEnabled(make_scoped_refptr(extension));
   registry_->RemoveDisabled(extension->id());
 
@@ skipping 321 matching lines @@
       to_unload.push_back(extension->id());
     Extension::DisableReason disable_reason = Extension::DISABLE_NONE;
     if (system_->management_policy()->MustRemainDisabled(
             extension.get(), &disable_reason, nullptr))
       to_disable[extension->id()] = disable_reason;
   }
 
   extensions::ExtensionManagement* management =
       extensions::ExtensionManagementFactory::GetForBrowserContext(profile());
 
+  for (const auto& extension : registry_->enabled_extensions()) {
+    extensions::PermissionsUpdater(profile()).SetRuntimeBlockedAllowedHosts(
+      extension.get(), management->GetRuntimeBlockedHosts(extension.get()),
+      management->GetRuntimeAllowedHosts(extension.get()));
+  }
+
   // Loop through the disabled extension list, find extensions to re-enable
   // automatically. These extensions are exclusive from the |to_disable| and
   // |to_unload| lists constructed above, since disabled_extensions() and
   // enabled_extensions() are supposed to be mutually exclusive.
   for (const auto& extension : registry_->disabled_extensions()) {
     // Find all disabled extensions disabled due to minimum version requirement,
     // but now satisfying it.
     if (management->CheckMinimumVersion(extension.get(), nullptr) &&
         extension_prefs_->HasDisableReason(
             extension->id(), Extension::DISABLE_UPDATE_REQUIRED_BY_POLICY)) {
@@ skipping 228 matching lines @@
   // TODO(jstritar): We may be able to get rid of this branch by overriding the
   // default extension state to DISABLED when the --disable-extensions flag
   // is set (http://crbug.com/29067).
   if (!extensions_enabled() && !extension->is_theme() &&
       extension->location() != Manifest::COMPONENT &&
       !Manifest::IsExternalLocation(extension->location()) &&
       disable_flag_exempted_extensions_.count(extension->id()) == 0) {
     return;
   }
 
+  extensions::ExtensionManagement* settings =
+      extensions::ExtensionManagementFactory::GetForBrowserContext(profile());
+  CHECK(settings);
+  extensions::PermissionsUpdater(profile()).SetRuntimeBlockedAllowedHosts(
+        extension, settings->GetRuntimeBlockedHosts(extension),
+        settings->GetRuntimeAllowedHosts(extension));
+
   bool is_extension_upgrade = false;
   bool is_extension_loaded = false;
   const Extension* old = GetInstalledExtension(extension->id());
   if (old) {
     is_extension_loaded = true;
     int version_compare_result =
         extension->version()->CompareTo(*(old->version()));
     is_extension_upgrade = version_compare_result > 0;
     // Other than for unpacked extensions, CrxInstaller should have guaranteed
     // that we aren't downgrading.
@@ skipping 389 matching lines @@
   CHECK(settings);
   std::unique_ptr<ExtensionSet> all_extensions(
       registry_->GenerateInstalledExtensionsSet());
   for (const auto& extension : *all_extensions) {
     if (!settings->IsPermissionSetAllowed(
             extension.get(),
             extension->permissions_data()->active_permissions())) {
       extensions::PermissionsUpdater(profile()).RemovePermissionsUnsafe(
           extension.get(), *settings->GetBlockedPermissions(extension.get()));
     }
+    extensions::PermissionsUpdater(profile()).SetRuntimeBlockedAllowedHosts(
+        extension.get(), settings->GetRuntimeBlockedHosts(extension.get()),
+        settings->GetRuntimeAllowedHosts(extension.get()));
   }
 
   CheckManagementPolicy();
 }
 
 void ExtensionService::AddNewOrUpdatedExtension(
     const Extension* extension,
     Extension::State initial_state,
     int install_flags,
     const syncer::StringOrdinal& page_ordinal,
@@ skipping 594 matching lines @@
 }
 
 void ExtensionService::OnProfileDestructionStarted() {
   ExtensionIdSet ids_to_unload = registry_->enabled_extensions().GetIDs();
   for (ExtensionIdSet::iterator it = ids_to_unload.begin();
        it != ids_to_unload.end();
        ++it) {
     UnloadExtension(*it, UnloadedExtensionInfo::REASON_PROFILE_SHUTDOWN);
   }
 }