Communicate ExtensionSettings policy to renderers

extensions/renderer/dispatcher.cc

Index: extensions/renderer/dispatcher.cc
diff --git a/extensions/renderer/dispatcher.cc b/extensions/renderer/dispatcher.cc
index fe1cff9c125c395142fc73e8489cfdee47110f17..dfc8be818c629cb0cdec1f1fbe689f17ace0c2fd 100644
--- a/extensions/renderer/dispatcher.cc
+++ b/extensions/renderer/dispatcher.cc
@@ -934,6 +934,10 @@ bool Dispatcher::OnControlMessageReceived(const IPC::Message& message) {
   IPC_MESSAGE_HANDLER(ExtensionMsg_TransferBlobs, OnTransferBlobs)
   IPC_MESSAGE_HANDLER(ExtensionMsg_Unloaded, OnUnloaded)
   IPC_MESSAGE_HANDLER(ExtensionMsg_UpdatePermissions, OnUpdatePermissions)
+  IPC_MESSAGE_HANDLER(ExtensionMsg_UpdateAllowedAndBlockedHosts,
+                      OnUpdateAllowedAndBlockedHosts)
+  IPC_MESSAGE_HANDLER(ExtensionMsg_UpdateDefaultAllowedAndBlockedHosts,
+                      OnUpdateDefaultAllowedAndBlockedHosts)
   IPC_MESSAGE_HANDLER(ExtensionMsg_UpdateTabSpecificPermissions,
                       OnUpdateTabSpecificPermissions)
   IPC_MESSAGE_HANDLER(ExtensionMsg_ClearTabSpecificPermissions,
@@ -1080,6 +1084,16 @@ void Dispatcher::OnLoaded(
       // consider making this a release CHECK.
       NOTREACHED();
     }
+    URLPatternSet runtime_allowed_hosts;
+    URLPatternSet runtime_blocked_hosts;
+    if (!param.is_default_runtime_blocked_allowed_hosts) {
+      if (!base::SharedMemory::IsHandleValid(param.hosts.hosts))
+        return;
+      param.hosts.Unpickle(&runtime_blocked_hosts, &runtime_allowed_hosts);
+    }
+    extension->permissions_data()->SetRuntimeBlockedAllowedHosts(
+        runtime_blocked_hosts, runtime_allowed_hosts,
+        param.is_default_runtime_blocked_allowed_hosts);
   }
 
   // Update the available bindings for all contexts. These may have changed if
@@ -1187,6 +1201,42 @@ void Dispatcher::OnUnloaded(const std::string& id) {
   // extension's URL just won't match anything anymore.
 }
 
+void Dispatcher::OnUpdateAllowedAndBlockedHosts(
+    const ExtensionMsg_UpdateAllowedAndBlockedHosts_Params& params) {
+  const Extension* extension =
+      RendererExtensionRegistry::Get()->GetByID(params.extension_id);
+  if (!extension)
+    return;
+
+  URLPatternSet runtime_allowed_hosts;
+  URLPatternSet runtime_blocked_hosts;
+  // We don't bother mapping memory if extension uses default
+  if (!params.is_default) {
+    if (!base::SharedMemory::IsHandleValid(params.hosts.hosts))
+      return;
+    params.hosts.Unpickle(&runtime_blocked_hosts, &runtime_allowed_hosts);
+  }
+
+  extension->permissions_data()->SetRuntimeBlockedAllowedHosts(

[Devlin, 2017/01/09 23:30:57]

Do we need to be able to support runtime extension permission changes?  Or could
this just happen on startup, in which case we can just send these over as part
of the initial extension state?

[nrpeter, 2017/01/10 17:48:05]

We do need to support changes to the policy during runtime. There are a number
of situations where this is necessary (blacklisting an extension, granting an
exception, fixing a policy mistake, etc.). 

+      runtime_blocked_hosts, runtime_allowed_hosts, params.is_default);
+
+  UpdateBindings(extension->id());
+}
+
+void Dispatcher::OnUpdateDefaultAllowedAndBlockedHosts(
+    const ExtensionMsg_RuntimeBlockedAllowedHostsStruct& params) {
+  URLPatternSet default_runtime_allowed_hosts;
+  URLPatternSet default_runtime_blocked_hosts;
+  if (!base::SharedMemory::IsHandleValid(params.hosts))
+    return;
+  params.Unpickle(&default_runtime_blocked_hosts,
+                  &default_runtime_allowed_hosts);
+  PermissionsData::SetDefaultRuntimeBlockedAllowedHosts(
+      default_runtime_blocked_hosts, default_runtime_allowed_hosts);
+
+  UpdateBindings("");
+}
+
 void Dispatcher::OnUpdatePermissions(
     const ExtensionMsg_UpdatePermissions_Params& params) {
   const Extension* extension =