PS - Remove Clipboard Read permission from extensions in Public Sessions (except for whitelisted on…

chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
 
 #include <stddef.h>
 
 #include <cstddef>
 #include <string>
@@ skipping 871 matching lines @@
 DeviceLocalAccountManagementPolicyProvider::
     DeviceLocalAccountManagementPolicyProvider(
         policy::DeviceLocalAccount::Type account_type)
     : account_type_(account_type) {
 }
 
 DeviceLocalAccountManagementPolicyProvider::
     ~DeviceLocalAccountManagementPolicyProvider() {
 }
 
+// static
+bool DeviceLocalAccountManagementPolicyProvider::IsWhitelisted(
+    const extensions::Extension* extension) {
+  return ArrayContains(kPublicSessionWhitelist, extension->id());
+}
+
 std::string DeviceLocalAccountManagementPolicyProvider::
     GetDebugPolicyProviderName() const {
 #if defined(NDEBUG)
   NOTREACHED();
   return std::string();
 #else
   return "whitelist for device-local accounts";
 #endif
 }
 
 bool DeviceLocalAccountManagementPolicyProvider::UserMayLoad(
     const extensions::Extension* extension,
     base::string16* error) const {
   if (account_type_ == policy::DeviceLocalAccount::TYPE_PUBLIC_SESSION) {
     // Allow extension if it is an externally hosted component of Chrome.
     if (extension->location() == extensions::Manifest::EXTERNAL_COMPONENT) {
       return true;
     }
 
     // TODO(isandrk): Remove when whitelisting work is done (crbug/651027).
     // Allow extension if its type is whitelisted for use in public sessions.
     if (extension->GetType() == extensions::Manifest::TYPE_HOSTED_APP) {
       return true;
     }
 
     // Allow extension if its specific ID is whitelisted for use in public
     // sessions.
-    if (ArrayContains(kPublicSessionWhitelist, extension->id())) {
+    if (IsWhitelisted(extension)) {
       return true;
     }
 
     // Allow force-installed extension if all manifest contents are whitelisted.
     if ((extension->location() == extensions::Manifest::EXTERNAL_POLICY_DOWNLOAD
          || extension->location() == extensions::Manifest::EXTERNAL_POLICY)
         && IsSafeForPublicSession(extension)) {
       return true;
     }
   } else if (account_type_ == policy::DeviceLocalAccount::TYPE_KIOSK_APP) {
@@ skipping 10 matching lines @@
   if (error) {
     *error = l10n_util::GetStringFUTF16(
           IDS_EXTENSION_CANT_INSTALL_IN_DEVICE_LOCAL_ACCOUNT,
           base::UTF8ToUTF16(extension->name()),
           base::UTF8ToUTF16(extension->id()));
   }
   return false;
 }
 
 }  // namespace chromeos