Communicate ExtensionSettings policy to renderers

chrome/common/extensions/permissions/permissions_data_unittest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 
 #include <utility>
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/memory/ref_counted.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "chrome/common/extensions/extension_test_util.h"
 #include "components/crx_file/id_util.h"
 #include "content/public/common/socket_permission_request.h"
+#include "extensions/common/constants.h"
 #include "extensions/common/error_utils.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/extension_builder.h"
 #include "extensions/common/manifest.h"
 #include "extensions/common/manifest_constants.h"
 #include "extensions/common/permissions/api_permission.h"
 #include "extensions/common/permissions/permission_message_test_util.h"
 #include "extensions/common/permissions/permission_set.h"
 #include "extensions/common/permissions/permissions_data.h"
 #include "extensions/common/permissions/socket_permission.h"
@@ skipping 42 matching lines @@
                        .Set("version", "1.0.0")
                        .Set("permissions", permissions.Build())
                        .Build())
       .SetLocation(location)
       .SetID(id)
       .Build();
 }
 
 // Checks that urls are properly restricted for the given extension.
 void CheckRestrictedUrls(const Extension* extension,
-                         bool block_chrome_urls) {
+                         bool block_chrome_urls,
+                         bool block_google_urls) {
   // We log the name so we know _which_ extension failed here.
   const std::string& name = extension->name();
   const GURL chrome_settings_url("chrome://settings/");
   const GURL chrome_extension_url("chrome-extension://foo/bar.html");
   const GURL google_url("https://www.google.com/");
   const GURL self_url("chrome-extension://" + extension->id() + "/foo.html");
   const GURL invalid_url("chrome-debugger://foo/bar.html");
 
   std::string error;
   EXPECT_EQ(block_chrome_urls,
@@ skipping 10 matching lines @@
   EXPECT_EQ(block_chrome_urls,
             PermissionsData::IsRestrictedUrl(
                 chrome_extension_url,
                 extension,
                 &error)) << name;
   if (block_chrome_urls)
     EXPECT_EQ(manifest_errors::kCannotAccessExtensionUrl, error) << name;
   else
     EXPECT_TRUE(error.empty()) << name;
 
-  // Google should never be a restricted url.
+  // Google shouldn't be restricted unless a runtime host restriction is applied
+  // by policy.
   error.clear();
-  EXPECT_FALSE(PermissionsData::IsRestrictedUrl(
-      google_url, extension, &error)) << name;
-  EXPECT_TRUE(error.empty()) << name;
+  EXPECT_EQ(block_google_urls,
+            PermissionsData::IsRestrictedUrl(google_url, extension, &error))
+      << name;
+  if (block_google_urls)
+    EXPECT_EQ(extension_misc::kPolicyBlockedScripting, error) << name;
+  else
+    EXPECT_TRUE(error.empty()) << name;
 
   // We should always be able to access our own extension pages.
   error.clear();
   EXPECT_FALSE(PermissionsData::IsRestrictedUrl(
       self_url, extension, &error)) << name;
   EXPECT_TRUE(error.empty()) << name;
 
   // We should only allow other schemes for extensions when it's a whitelisted
   // extension.
   error.clear();
@@ skipping 91 matching lines @@
   EXPECT_TRUE(hosts.MatchesURL(GURL("http://www.google.com")));
   EXPECT_TRUE(extension->permissions_data()->HasEffectiveAccessToAllHosts());
 
   // Tab-specific permissions should be included in the effective hosts.
   GURL tab_url("http://www.example.com/");
   URLPatternSet new_hosts;
   new_hosts.AddOrigin(URLPattern::SCHEME_ALL, tab_url);
   extension->permissions_data()->UpdateTabSpecificPermissions(
       1, PermissionSet(APIPermissionSet(), ManifestPermissionSet(), new_hosts,
                        URLPatternSet()));
-  EXPECT_TRUE(extension->permissions_data()->GetEffectiveHostPermissions().
-      MatchesURL(tab_url));
+  EXPECT_TRUE(

[nrpeter, 2017/04/05 23:13:26]

I ran git cl format, and this happened.... 

Do you want me to revert these?

[Devlin, 2017/04/07 00:40:27]

nah, git cl format changes are fine, as long as they're areas that your CL
touches.

[nrpeter, 2017/04/12 23:35:45]

Done.

+      extension->permissions_data()->GetEffectiveHostPermissions().MatchesURL(
+          tab_url));
   extension->permissions_data()->ClearTabSpecificPermissions(1);
-  EXPECT_FALSE(extension->permissions_data()->GetEffectiveHostPermissions().
-      MatchesURL(tab_url));
+  EXPECT_FALSE(
+      extension->permissions_data()->GetEffectiveHostPermissions().MatchesURL(
+          tab_url));
 }
 
 TEST(PermissionsDataTest, SocketPermissions) {
   scoped_refptr<Extension> extension;
   std::string error;
 
   extension = LoadManifest("socket_permissions", "empty.json");
-  EXPECT_FALSE(CheckSocketPermission(extension,
-      SocketPermissionRequest::TCP_CONNECT, "www.example.com", 80));
+  EXPECT_FALSE(CheckSocketPermission(
+      extension, SocketPermissionRequest::TCP_CONNECT, "www.example.com", 80));

[nrpeter, 2017/04/05 23:13:27]

Ditto

[nrpeter, 2017/04/12 23:35:45]

Done.

 
   extension = LoadManifestUnchecked("socket_permissions",
                                     "socket1.json",
                                     Manifest::INTERNAL, Extension::NO_FLAGS,
                                     &error);
   EXPECT_TRUE(extension.get() == NULL);
   std::string expected_error_msg_header = ErrorUtils::FormatErrorMessage(
       manifest_errors::kInvalidPermissionWithDetail,
       "socket",
       "NULL or empty permission list");
   EXPECT_EQ(expected_error_msg_header, error);
 
   extension = LoadManifest("socket_permissions", "socket2.json");
-  EXPECT_TRUE(CheckSocketPermission(extension,
-      SocketPermissionRequest::TCP_CONNECT, "www.example.com", 80));
+  EXPECT_TRUE(CheckSocketPermission(
+      extension, SocketPermissionRequest::TCP_CONNECT, "www.example.com", 80));
   EXPECT_FALSE(CheckSocketPermission(
-        extension, SocketPermissionRequest::UDP_BIND, "", 80));
+      extension, SocketPermissionRequest::UDP_BIND, "", 80));
   EXPECT_TRUE(CheckSocketPermission(
-        extension, SocketPermissionRequest::UDP_BIND, "", 8888));
+      extension, SocketPermissionRequest::UDP_BIND, "", 8888));
 
   EXPECT_FALSE(CheckSocketPermission(
-        extension, SocketPermissionRequest::UDP_SEND_TO, "example.com", 1900));
-  EXPECT_TRUE(CheckSocketPermission(
-        extension,
-        SocketPermissionRequest::UDP_SEND_TO,
-        "239.255.255.250", 1900));
+      extension, SocketPermissionRequest::UDP_SEND_TO, "example.com", 1900));
+  EXPECT_TRUE(CheckSocketPermission(extension,
+                                    SocketPermissionRequest::UDP_SEND_TO,
+                                    "239.255.255.250", 1900));

[nrpeter, 2017/04/05 23:13:27]

Ditto

[nrpeter, 2017/04/12 23:35:45]

Done.

 }
 
 TEST(PermissionsDataTest, IsRestrictedUrl) {
   scoped_refptr<const Extension> extension =
       GetExtensionWithHostPermission("normal_extension",
                                      kAllHostsPermission,
                                      Manifest::INTERNAL);
-  // Chrome urls should be blocked for normal extensions.
-  CheckRestrictedUrls(extension.get(), true);
+  // Chrome urls should be blocked for normal extensions, but not Google.
+  CheckRestrictedUrls(extension.get(), true, false);
+
+  scoped_refptr<const Extension> policy_extension =

[Devlin, 2017/04/07 00:40:27]

Let's make new tests for this.  Unit tests are cheap, and it ensures we don't
accidentally lose test coverage by extending an existing case.

[nrpeter, 2017/04/12 23:35:44]

Moved out of IsRestrictedUrl to this is no longer necessary.

+      GetExtensionWithHostPermission("policy_host_restriction_extension",
+                                     kAllHostsPermission, Manifest::INTERNAL);
+  URLPatternSet blocked;
+  URLPatternSet allowed;
+  blocked.AddPattern(
+      URLPattern(URLPattern::SCHEME_ALL, "https://*.google.com/*"));
+  policy_extension->permissions_data()->SetPolicyHostRestrictions(blocked,
+                                                                  allowed);
+  // Chrome urls should be blocked & Google urls should be blocked by policy.
+  CheckRestrictedUrls(policy_extension.get(), true, true);
 
   scoped_refptr<const Extension> component =
       GetExtensionWithHostPermission("component",
                                      kAllHostsPermission,
                                      Manifest::COMPONENT);
   // Chrome urls should be accessible by component extensions.
-  CheckRestrictedUrls(component.get(), false);
+  CheckRestrictedUrls(component.get(), false, false);
+
+  scoped_refptr<const Extension> policy_component =
+      GetExtensionWithHostPermission("component", kAllHostsPermission,
+                                     Manifest::COMPONENT);
+  // Chrome urls should be accessible by component extensions & Google urls
+  // should be blocked by policy.
+  policy_component->permissions_data()->SetPolicyHostRestrictions(blocked,
+                                                                  allowed);
+  CheckRestrictedUrls(policy_component.get(), false, true);
 
   base::CommandLine::ForCurrentProcess()->AppendSwitch(
       switches::kExtensionsOnChromeURLs);
   // Enabling the switch should allow all extensions to access chrome urls.
-  CheckRestrictedUrls(extension.get(), false);
+  CheckRestrictedUrls(extension.get(), false, false);
 }
 
 TEST(PermissionsDataTest, GetPermissionMessages_ManyAPIPermissions) {
   scoped_refptr<Extension> extension;
   extension = LoadManifest("permissions", "many-apis.json");
   // Warning for "tabs" is suppressed by "history" permission.
   std::vector<std::string> expected_messages;
   expected_messages.push_back("Read and change your data on api.flickr.com");
   expected_messages.push_back("Read and change your bookmarks");
   expected_messages.push_back("Detect your physical location");
@@ skipping 76 matching lines @@
 }
 
 // Base class for testing the CanAccessPage and CanCaptureVisiblePage
 // methods of Extension for extensions with various permissions.
 class ExtensionScriptAndCaptureVisibleTest : public testing::Test {
  protected:
   ExtensionScriptAndCaptureVisibleTest()
       : http_url("http://www.google.com"),
         http_url_with_path("http://www.google.com/index.html"),
         https_url("https://www.google.com"),
+        https_url_diff_subdomain("https://example.google.com"),
         file_url("file:///foo/bar"),
         favicon_url("chrome://favicon/http://www.google.com"),
         extension_url("chrome-extension://" +
                       crx_file::id_util::GenerateIdForPath(
                           base::FilePath(FILE_PATH_LITERAL("foo")))),
         settings_url("chrome://settings"),
         about_url("about:flags") {
     urls_.insert(http_url);
     urls_.insert(http_url_with_path);
     urls_.insert(https_url);
+    urls_.insert(https_url_diff_subdomain);
     urls_.insert(file_url);
     urls_.insert(favicon_url);
     urls_.insert(extension_url);
     urls_.insert(settings_url);
     urls_.insert(about_url);
     // Ignore the policy delegate for this test.
     PermissionsData::SetPolicyDelegate(NULL);
   }
 
   bool AllowedScript(const Extension* extension, const GURL& url) {
@@ skipping 65 matching lines @@
         result &= Blocked(extension, url, tab_id);
     }
     return result;
   }
 
   // URLs that are "safe" to provide scripting and capture visible tab access
   // to if the permissions allow it.
   const GURL http_url;
   const GURL http_url_with_path;
   const GURL https_url;
+  const GURL https_url_diff_subdomain;
   const GURL file_url;
 
   // We should allow host permission but not scripting permission for favicon
   // urls.
   const GURL favicon_url;
 
   // URLs that regular extensions should never get access to.
   const GURL extension_url;
   const GURL settings_url;
   const GURL about_url;
@@ skipping 96 matching lines @@
   EXPECT_FALSE(extension->permissions_data()->HasHostPermission(settings_url));
 }
 
 TEST_F(ExtensionScriptAndCaptureVisibleTest, PermissionsWithChromeURLsEnabled) {
   base::CommandLine::ForCurrentProcess()->AppendSwitch(
       switches::kExtensionsOnChromeURLs);
 
   scoped_refptr<Extension> extension;
 
   // Test <all_urls> for regular extensions.
-  extension = LoadManifestStrict("script_and_capture",
-      "extension_regular_all.json");
+  extension =
+      LoadManifestStrict("script_and_capture", "extension_regular_all.json");

[nrpeter, 2017/04/05 23:13:27]

Ditto

[nrpeter, 2017/04/12 23:35:44]

Done.

   EXPECT_TRUE(Allowed(extension.get(), http_url));
   EXPECT_TRUE(Allowed(extension.get(), https_url));
   EXPECT_TRUE(CaptureOnly(extension.get(), file_url));
   EXPECT_TRUE(CaptureOnly(extension.get(), settings_url));
   EXPECT_TRUE(Allowed(extension.get(), favicon_url));  // chrome:// requested
   EXPECT_TRUE(CaptureOnly(extension.get(), about_url));
   EXPECT_TRUE(CaptureOnly(extension.get(), extension_url));
 
   // Test access to iframed content.
   GURL within_extension_url = extension->GetResourceURL("page.html");
   EXPECT_TRUE(AllowedScript(extension.get(), http_url));
   EXPECT_TRUE(AllowedScript(extension.get(), http_url_with_path));
   EXPECT_TRUE(AllowedScript(extension.get(), https_url));
   EXPECT_TRUE(BlockedScript(extension.get(), within_extension_url));
   EXPECT_TRUE(BlockedScript(extension.get(), extension_url));
 
   const PermissionsData* permissions_data = extension->permissions_data();
   EXPECT_FALSE(permissions_data->HasHostPermission(settings_url));
   EXPECT_FALSE(permissions_data->HasHostPermission(about_url));
   EXPECT_TRUE(permissions_data->HasHostPermission(favicon_url));
 
   // Test * for scheme, which implies just the http/https schemes.
-  extension = LoadManifestStrict("script_and_capture",
-      "extension_wildcard.json");
+  extension =
+      LoadManifestStrict("script_and_capture", "extension_wildcard.json");
   EXPECT_TRUE(ScriptOnly(extension.get(), http_url));
   EXPECT_TRUE(ScriptOnly(extension.get(), https_url));
   EXPECT_TRUE(Blocked(extension.get(), settings_url));
   EXPECT_TRUE(Blocked(extension.get(), about_url));
   EXPECT_TRUE(Blocked(extension.get(), file_url));
   EXPECT_TRUE(Blocked(extension.get(), favicon_url));
   extension =
       LoadManifest("script_and_capture", "extension_wildcard_settings.json");
   EXPECT_TRUE(Blocked(extension.get(), settings_url));
 
   // Having chrome://*/ should work for regular extensions with the flag
   // enabled.
   std::string error;
   extension = LoadManifestUnchecked("script_and_capture",
                                     "extension_wildcard_chrome.json",
                                     Manifest::INTERNAL, Extension::NO_FLAGS,
                                     &error);
   EXPECT_FALSE(extension.get() == NULL);
   EXPECT_TRUE(Blocked(extension.get(), http_url));
   EXPECT_TRUE(Blocked(extension.get(), https_url));
   EXPECT_TRUE(ScriptOnly(extension.get(), settings_url));
   EXPECT_TRUE(Blocked(extension.get(), about_url));
   EXPECT_TRUE(Blocked(extension.get(), file_url));
   EXPECT_TRUE(ScriptOnly(extension.get(), favicon_url));
 
   // Having chrome://favicon/* should not give you chrome://*
   extension = LoadManifestStrict("script_and_capture",
-      "extension_chrome_favicon_wildcard.json");
+                                 "extension_chrome_favicon_wildcard.json");
   EXPECT_TRUE(Blocked(extension.get(), settings_url));
   EXPECT_TRUE(ScriptOnly(extension.get(), favicon_url));
   EXPECT_TRUE(Blocked(extension.get(), about_url));
   EXPECT_TRUE(extension->permissions_data()->HasHostPermission(favicon_url));
 
   // Having http://favicon should not give you chrome://favicon
-  extension = LoadManifestStrict("script_and_capture",
-      "extension_http_favicon.json");
+  extension =
+      LoadManifestStrict("script_and_capture", "extension_http_favicon.json");
   EXPECT_TRUE(Blocked(extension.get(), settings_url));
   EXPECT_TRUE(Blocked(extension.get(), favicon_url));
 
   // Component extensions with <all_urls> should get everything.
   extension = LoadManifest("script_and_capture", "extension_component_all.json",
-      Manifest::COMPONENT, Extension::NO_FLAGS);
+                           Manifest::COMPONENT, Extension::NO_FLAGS);
   EXPECT_TRUE(Allowed(extension.get(), http_url));
   EXPECT_TRUE(Allowed(extension.get(), https_url));
   EXPECT_TRUE(Allowed(extension.get(), settings_url));
   EXPECT_TRUE(Allowed(extension.get(), about_url));
   EXPECT_TRUE(Allowed(extension.get(), favicon_url));
   EXPECT_TRUE(extension->permissions_data()->HasHostPermission(favicon_url));
 
   // Component extensions should only get access to what they ask for.
-  extension = LoadManifest("script_and_capture",
-      "extension_component_google.json", Manifest::COMPONENT,
-      Extension::NO_FLAGS);
+  extension =
+      LoadManifest("script_and_capture", "extension_component_google.json",
+                   Manifest::COMPONENT, Extension::NO_FLAGS);
   EXPECT_TRUE(ScriptOnly(extension.get(), http_url));
   EXPECT_TRUE(Blocked(extension.get(), https_url));
   EXPECT_TRUE(Blocked(extension.get(), file_url));
   EXPECT_TRUE(Blocked(extension.get(), settings_url));
   EXPECT_TRUE(Blocked(extension.get(), favicon_url));
   EXPECT_TRUE(Blocked(extension.get(), about_url));
   EXPECT_TRUE(Blocked(extension.get(), extension_url));
   EXPECT_FALSE(extension->permissions_data()->HasHostPermission(settings_url));
 }
 
@@ skipping 78 matching lines @@
   EXPECT_TRUE(ScriptAllowedExclusivelyOnTab(extension.get(), no_urls, 2));
 
   permissions_data->ClearTabSpecificPermissions(1);
   EXPECT_FALSE(permissions_data->GetTabSpecificPermissionsForTesting(1));
 
   EXPECT_TRUE(ScriptAllowedExclusivelyOnTab(extension.get(), no_urls, 0));
   EXPECT_TRUE(ScriptAllowedExclusivelyOnTab(extension.get(), no_urls, 1));
   EXPECT_TRUE(ScriptAllowedExclusivelyOnTab(extension.get(), no_urls, 2));
 }
 
+TEST_F(ExtensionScriptAndCaptureVisibleTest, PolicyHostRestrictionsSwap) {
+  // Makes sure when an extension gets an individual policy for host
+  // restrictions it overrides the default policy. Also tests transitioning back
+  // to the default policy when an individual policy is removed.
+  URLPatternSet default_blocked;
+  URLPatternSet default_allowed;
+  default_blocked.AddPattern(
+      URLPattern(URLPattern::SCHEME_ALL, "https://*.google.com/*"));
+  default_allowed.AddPattern(
+      URLPattern(URLPattern::SCHEME_ALL, "https://example.google.com/*"));
+
+  // Test <all_urls> for regular extensions.
+  scoped_refptr<Extension> extension =
+      LoadManifestStrict("script_and_capture", "extension_regular_all.json");
+  extension->permissions_data()->SetDefaultPolicyHostRestrictions(
+      default_blocked, default_allowed);
+
+  // Default policy example.google.com OK, any other google subdomain blocked.
+  EXPECT_TRUE(CaptureOnly(extension.get(), https_url));

[Devlin, 2017/04/07 00:40:26]

These variables (https_url, https_url_diff_subdomain) aren't very descriptive
for this particular test case (which is more interested in hosts).  Let's make
new ones to make reading this easier.

[nrpeter, 2017/04/12 23:35:45]

Done.

+  EXPECT_TRUE(Allowed(extension.get(), https_url_diff_subdomain));
+
+  URLPatternSet blocked;
+  blocked.AddPattern(
+      URLPattern(URLPattern::SCHEME_ALL, "https://example.google.com/*"));
+  URLPatternSet allowed;
+  extension->permissions_data()->SetPolicyHostRestrictions(blocked, allowed);
+  // Individual poilcy example.google.com BLOCKED.

[Devlin, 2017/04/07 00:40:27]

typo: policy

[nrpeter, 2017/04/12 23:35:45]

Done.

[nrpeter, 2017/04/12 23:35:45]

Done.

+  EXPECT_TRUE(Allowed(extension.get(), https_url));
+  EXPECT_TRUE(CaptureOnly(extension.get(), https_url_diff_subdomain));
+
+  // Individual policy example.google.com OK, other google subdomains blocked.
+  // Tests that URL is allowed if same URL in blocked and allowed.

[Devlin, 2017/04/07 00:40:27]

Use proper grammar in comments, e.g. "Tests that an extension is allowed access
to a given URL if that URL is in both the blocked and allowed sets of the
policy."  (Goes for everywhere)

https://google.github.io/styleguide/cppguide.html#Punctuation,_Spelling_and_G...

[nrpeter, 2017/04/12 23:35:45]

Done.

+  blocked.AddPattern(
+      URLPattern(URLPattern::SCHEME_ALL, "https://*.google.com/*"));
+  allowed.AddPattern(
+      URLPattern(URLPattern::SCHEME_ALL, "https://example.google.com/*"));
+  extension->permissions_data()->SetPolicyHostRestrictions(blocked, allowed);
+  EXPECT_TRUE(CaptureOnly(extension.get(), https_url));
+  EXPECT_TRUE(Allowed(extension.get(), https_url_diff_subdomain));
+
+  // Clear Individual plan.
+  blocked.ClearPatterns();
+  allowed.ClearPatterns();
+  extension->permissions_data()->SetPolicyHostRestrictions(blocked, allowed);
+  EXPECT_TRUE(Allowed(extension.get(), https_url));
+  EXPECT_TRUE(Allowed(extension.get(), https_url_diff_subdomain));
+
+  // Flip back to using default policy for this extension.
+  extension->permissions_data()->SetUsesDefaultHostRestrictions();
+
+  // Default policy example.google.com OK, any other google subdomain blocked.
+  EXPECT_TRUE(CaptureOnly(extension.get(), https_url));
+  EXPECT_TRUE(Allowed(extension.get(), https_url_diff_subdomain));
+}
+
+TEST_F(ExtensionScriptAndCaptureVisibleTest, PolicyHostRestrictions) {
+  URLPatternSet default_blocked;
+  URLPatternSet default_allowed;
+  default_blocked.AddPattern(
+      URLPattern(URLPattern::SCHEME_ALL, "https://*.google.com/*"));
+  default_allowed.AddPattern(
+      URLPattern(URLPattern::SCHEME_ALL, "https://example.google.com/*"));
+
+  // Test <all_urls> for regular extensions.
+  scoped_refptr<Extension> extension =
+      LoadManifestStrict("script_and_capture", "extension_regular_all.json");
+  extension->permissions_data()->SetDefaultPolicyHostRestrictions(
+      default_blocked, default_allowed);
+
+  EXPECT_TRUE(Allowed(extension.get(), http_url));
+  EXPECT_TRUE(CaptureOnly(extension.get(), https_url));
+  EXPECT_TRUE(Allowed(extension.get(), https_url_diff_subdomain));
+  EXPECT_TRUE(CaptureOnly(extension.get(), file_url));
+  EXPECT_TRUE(CaptureOnly(extension.get(), settings_url));
+  EXPECT_TRUE(CaptureOnly(extension.get(), favicon_url));
+  EXPECT_TRUE(CaptureOnly(extension.get(), about_url));
+  EXPECT_TRUE(CaptureOnly(extension.get(), extension_url));
+
+  // Test access to iframed content.
+  GURL within_extension_url = extension->GetResourceURL("page.html");
+  EXPECT_TRUE(AllowedScript(extension.get(), http_url));
+  EXPECT_TRUE(AllowedScript(extension.get(), http_url_with_path));
+  EXPECT_TRUE(AllowedScript(extension.get(), https_url_diff_subdomain));
+  EXPECT_TRUE(BlockedScript(extension.get(), https_url));
+  EXPECT_TRUE(BlockedScript(extension.get(), within_extension_url));
+  EXPECT_TRUE(BlockedScript(extension.get(), extension_url));
+
+  EXPECT_FALSE(extension->permissions_data()->HasHostPermission(settings_url));
+  EXPECT_FALSE(extension->permissions_data()->HasHostPermission(about_url));
+  EXPECT_TRUE(extension->permissions_data()->HasHostPermission(favicon_url));
+
+  // Test * for scheme, which implies just the http/https schemes.
+  extension =
+      LoadManifestStrict("script_and_capture", "extension_wildcard.json");
+  extension->permissions_data()->SetDefaultPolicyHostRestrictions(
+      default_blocked, default_allowed);
+  EXPECT_TRUE(ScriptOnly(extension.get(), http_url));
+  EXPECT_TRUE(ScriptOnly(extension.get(), https_url_diff_subdomain));
+  EXPECT_TRUE(Blocked(extension.get(), https_url));
+  EXPECT_TRUE(Blocked(extension.get(), settings_url));
+  EXPECT_TRUE(Blocked(extension.get(), about_url));
+  EXPECT_TRUE(Blocked(extension.get(), file_url));
+  EXPECT_TRUE(Blocked(extension.get(), favicon_url));
+  extension =
+      LoadManifest("script_and_capture", "extension_wildcard_settings.json");
+  extension->permissions_data()->SetDefaultPolicyHostRestrictions(
+      default_blocked, default_allowed);
+  EXPECT_TRUE(Blocked(extension.get(), settings_url));
+
+  // Having chrome://*/ should not work for regular extensions. Note that
+  // for favicon access, we require the explicit pattern chrome://favicon/*.
+  std::string error;
+  extension = LoadManifestUnchecked(
+      "script_and_capture", "extension_wildcard_chrome.json",
+      Manifest::INTERNAL, Extension::NO_FLAGS, &error);
+  extension->permissions_data()->SetDefaultPolicyHostRestrictions(
+      default_blocked, default_allowed);
+  std::vector<InstallWarning> warnings = extension->install_warnings();
+  EXPECT_FALSE(warnings.empty());
+  EXPECT_EQ(ErrorUtils::FormatErrorMessage(
+                manifest_errors::kInvalidPermissionScheme, "chrome://*/"),
+            warnings[0].message);
+  EXPECT_TRUE(Blocked(extension.get(), settings_url));
+  EXPECT_TRUE(Blocked(extension.get(), favicon_url));
+  EXPECT_TRUE(Blocked(extension.get(), about_url));
+
+  // Having chrome://favicon/* should not give you chrome://*

[Devlin, 2017/04/07 00:40:27]

A lot of this test seems duplicative.  Can we either a) isolate the interesting
parts, or b) explain why we're retesting?

[nrpeter, 2017/04/12 23:35:45]

Good point, all the tests after the component test aren't needed.

+  extension = LoadManifestStrict("script_and_capture",
+                                 "extension_chrome_favicon_wildcard.json");
+  extension->permissions_data()->SetDefaultPolicyHostRestrictions(
+      default_blocked, default_allowed);
+  EXPECT_TRUE(Blocked(extension.get(), settings_url));
+  EXPECT_TRUE(Blocked(extension.get(), favicon_url));
+  EXPECT_TRUE(Blocked(extension.get(), about_url));
+  EXPECT_TRUE(extension->permissions_data()->HasHostPermission(favicon_url));
+
+  // Having http://favicon should not give you chrome://favicon
+  extension =
+      LoadManifestStrict("script_and_capture", "extension_http_favicon.json");
+  extension->permissions_data()->SetDefaultPolicyHostRestrictions(
+      default_blocked, default_allowed);
+  EXPECT_TRUE(Blocked(extension.get(), settings_url));
+  EXPECT_TRUE(Blocked(extension.get(), favicon_url));
+
+  // Component extensions with <all_urls> should get everything.
+  extension = LoadManifest("script_and_capture", "extension_component_all.json",
+                           Manifest::COMPONENT, Extension::NO_FLAGS);
+  extension->permissions_data()->SetDefaultPolicyHostRestrictions(
+      default_blocked, default_allowed);
+  EXPECT_TRUE(Allowed(extension.get(), http_url));
+  EXPECT_TRUE(CaptureOnly(extension.get(), https_url));
+  EXPECT_TRUE(Allowed(extension.get(), https_url_diff_subdomain));
+  EXPECT_TRUE(Allowed(extension.get(), settings_url));
+  EXPECT_TRUE(Allowed(extension.get(), about_url));
+  EXPECT_TRUE(Allowed(extension.get(), favicon_url));
+  EXPECT_TRUE(extension->permissions_data()->HasHostPermission(favicon_url));
+
+  // Component extensions should only get access to what they ask for.
+  extension =
+      LoadManifest("script_and_capture", "extension_component_google.json",
+                   Manifest::COMPONENT, Extension::NO_FLAGS);
+  extension->permissions_data()->SetDefaultPolicyHostRestrictions(
+      default_blocked, default_allowed);
+  EXPECT_TRUE(ScriptOnly(extension.get(), http_url));
+  EXPECT_TRUE(Blocked(extension.get(), https_url));
+  EXPECT_TRUE(Blocked(extension.get(), https_url_diff_subdomain));
+  EXPECT_TRUE(Blocked(extension.get(), file_url));
+  EXPECT_TRUE(Blocked(extension.get(), settings_url));
+  EXPECT_TRUE(Blocked(extension.get(), favicon_url));
+  EXPECT_TRUE(Blocked(extension.get(), about_url));
+  EXPECT_TRUE(Blocked(extension.get(), extension_url));
+  EXPECT_FALSE(extension->permissions_data()->HasHostPermission(settings_url));
+}
+
 }  // namespace extensions