Communicate ExtensionSettings policy to renderers

extensions/renderer/dispatcher.cc

Index: extensions/renderer/dispatcher.cc
diff --git a/extensions/renderer/dispatcher.cc b/extensions/renderer/dispatcher.cc
index fe1cff9c125c395142fc73e8489cfdee47110f17..70ed89fab74cce7e19a4323d4840dab067bb2b9e 100644
--- a/extensions/renderer/dispatcher.cc
+++ b/extensions/renderer/dispatcher.cc
@@ -934,6 +934,8 @@ bool Dispatcher::OnControlMessageReceived(const IPC::Message& message) {
   IPC_MESSAGE_HANDLER(ExtensionMsg_TransferBlobs, OnTransferBlobs)
   IPC_MESSAGE_HANDLER(ExtensionMsg_Unloaded, OnUnloaded)
   IPC_MESSAGE_HANDLER(ExtensionMsg_UpdatePermissions, OnUpdatePermissions)
+  IPC_MESSAGE_HANDLER(ExtensionMsg_UpdateDefaultPolicyHostRestrictions,
+                      OnUpdateDefaultPolicyHostRestrictions)
   IPC_MESSAGE_HANDLER(ExtensionMsg_UpdateTabSpecificPermissions,
                       OnUpdateTabSpecificPermissions)
   IPC_MESSAGE_HANDLER(ExtensionMsg_ClearTabSpecificPermissions,
@@ -1063,7 +1065,6 @@ void Dispatcher::OnLoaded(
       extension_load_errors_[param.id] = error;
       continue;
     }
-
     RendererExtensionRegistry* extension_registry =
         RendererExtensionRegistry::Get();
     // TODO(kalman): This test is deliberately not a CHECK (though I wish it
@@ -1080,6 +1081,11 @@ void Dispatcher::OnLoaded(
       // consider making this a release CHECK.
       NOTREACHED();
     }
+    URLPatternSet runtime_blocked_hosts = param.runtime_blocked_hosts;

[dcheng, 2017/02/06 07:05:29]

const URLPatternSet& here and below (the current implementation will copy twice
instead of just once)

[nrpeter, 2017/02/06 22:53:15]

Done.

+    URLPatternSet runtime_allowed_hosts = param.runtime_allowed_hosts;
+    extension->permissions_data()->SetPolicyHostRestrictions(
+        runtime_blocked_hosts, runtime_allowed_hosts,
+        param.is_default_runtime_blocked_allowed_hosts);
   }
 
   // Update the available bindings for all contexts. These may have changed if
@@ -1187,6 +1193,14 @@ void Dispatcher::OnUnloaded(const std::string& id) {
   // extension's URL just won't match anything anymore.
 }
 
+void Dispatcher::OnUpdateDefaultPolicyHostRestrictions(
+    const ExtensionMsg_UpdateDefaultPolicyHostRestrictions_Params& params) {
+  URLPatternSet blocked = params.default_runtime_blocked_hosts;
+  URLPatternSet allowed = params.default_runtime_allowed_hosts;
+  PermissionsData::SetDefaultPolicyHostRestrictions(blocked, allowed);
+  UpdateBindings("");

[dcheng, 2017/02/06 07:05:29]

Nit: std::string() rather than ""

[nrpeter, 2017/02/06 22:53:15]

Done.

FYI: Everywhere else in the file that we use UpdateBindings with an empty
string, it uses "".

[dcheng, 2017/02/07 07:47:12]

Yeah, it's more about long-term consistency here. "" is a bit sad; with
libstdc++, you get a heap allocation... to hold an empty string.

With SSO, it's a bit better, but it's even cheaper to not memcpy an empty string
to begin with.

[nrpeter, 2017/03/22 23:47:38]

Done.

+}
+
 void Dispatcher::OnUpdatePermissions(
     const ExtensionMsg_UpdatePermissions_Params& params) {
   const Extension* extension =
@@ -1206,6 +1220,15 @@ void Dispatcher::OnUpdatePermissions(
 
   extension->permissions_data()->SetPermissions(std::move(active),
                                                 std::move(withheld));
+  URLPatternSet runtime_blocked_hosts;
+  URLPatternSet runtime_allowed_hosts;
+  if (!params.uses_default_policy_host_restrictions) {
+    runtime_blocked_hosts = params.runtime_blocked_hosts;
+    runtime_allowed_hosts = params.runtime_allowed_hosts;
+  }
+  extension->permissions_data()->SetPolicyHostRestrictions(
+      runtime_blocked_hosts, runtime_allowed_hosts,
+      params.uses_default_policy_host_restrictions);
   UpdateBindings(extension->id());
 }