Communicate ExtensionSettings policy to renderers

chrome/browser/extensions/extension_service.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_service.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <iterator>
@@ skipping 1194 matching lines @@
     if (!system_->management_policy()->UserMayLoad(extension.get(), nullptr))
       to_unload.push_back(extension->id());
     Extension::DisableReason disable_reason = Extension::DISABLE_NONE;
     if (system_->management_policy()->MustRemainDisabled(
             extension.get(), &disable_reason, nullptr))
       to_disable[extension->id()] = disable_reason;
   }
 
   extensions::ExtensionManagement* management =
       extensions::ExtensionManagementFactory::GetForBrowserContext(profile());
+  for (const auto& extension : registry_->enabled_extensions()) {
+    bool uses_default =
+        management->UsesDefaultRuntimeHostRestrictions(extension.get());
+    if (!uses_default) {
+      extensions::PermissionsUpdater(profile()).SetPolicyHostRestrictions(
+          extension.get(), management->GetRuntimeBlockedHosts(extension.get()),
+          management->GetRuntimeAllowedHosts(extension.get()));
+    }
+    extensions::PermissionsUpdater(profile()).SetUsesDefaultHostRestrictions(

[Devlin, 2017/04/03 15:52:23]

this should be in an else.  As I've mentioned here [1], [2], [3], and related to
dcheng's comment, we should call *either* a method to set explicit host
restrictions *or* a method to set an extension to use the defaults; not both.

[1]
https://codereview.chromium.org/2499493004/diff/100001/extensions/common/perm...
[2]
https://codereview.chromium.org/2499493004/diff/100001/chrome/browser/extensi...
[3]
https://codereview.chromium.org/2499493004/diff/120001/chrome/browser/extensi...

[nrpeter, 2017/04/03 22:35:48]

Done.

+        extension.get(), uses_default);
+  }
+  extensions::PermissionsUpdater(profile()).SetDefaultPolicyHostRestrictions(
+      management->GetDefaultRuntimeBlockedHosts(),
+      management->GetDefaultRuntimeAllowedHosts());
 
   // Loop through the disabled extension list, find extensions to re-enable
   // automatically. These extensions are exclusive from the |to_disable| and
   // |to_unload| lists constructed above, since disabled_extensions() and
   // enabled_extensions() are supposed to be mutually exclusive.
   for (const auto& extension : registry_->disabled_extensions()) {
     // Find all disabled extensions disabled due to minimum version requirement,
     // but now satisfying it.
     if (management->CheckMinimumVersion(extension.get(), nullptr) &&
         extension_prefs_->HasDisableReason(
@@ skipping 1252 matching lines @@
 }
 
 void ExtensionService::OnProfileDestructionStarted() {
   ExtensionIdSet ids_to_unload = registry_->enabled_extensions().GetIDs();
   for (ExtensionIdSet::iterator it = ids_to_unload.begin();
        it != ids_to_unload.end();
        ++it) {
     UnloadExtension(*it, UnloadedExtensionInfo::REASON_PROFILE_SHUTDOWN);
   }
 }