PS - Filtering activeTab URL

chrome/browser/extensions/api/extension_action/extension_action_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/extension_action/extension_action_api.h"
 
 #include <stddef.h>
 #include <utility>
 
 #include "base/lazy_instance.h"
@@ skipping 207 matching lines @@
       event_name = "pageAction.onClicked";
       break;
     case ActionInfo::TYPE_SYSTEM_INDICATOR:
       // The System Indicator handles its own clicks.
       NOTREACHED();
       break;
   }
 
   if (event_name) {
     std::unique_ptr<base::ListValue> args(new base::ListValue());
-    args->Append(ExtensionTabUtil::CreateTabObject(web_contents)->ToValue());
+    std::unique_ptr<api::tabs::Tab> tab =
+        ExtensionTabUtil::CreateTabObject(web_contents);
+    ExtensionTabUtil::PlatformSpecificFiltering(extension_action.extension_id(),

[Ivan Šandrk, 2017/05/03 13:00:50]

Should I test this part maybe?

[Devlin, 2017/05/03 15:14:15]

Actually, I think that what we should be doing is passing in the extension as
part of the CreateTabObject call so that we perform the scrubbing there.  I
think it's probably a bug that we don't do that already.

Note that doing this *could* potentially break extensions if they happen to be
relying on getting the url of the tab while also not having host permission,
tabs permission, or activeTab permission, but I think that's the right behavior.
 We shouldn't be surfacing this information to the extension otherwise.

[Ivan Šandrk, 2017/05/03 17:52:46]

Right, thanks for the suggestion. Done.

+                                                tab.get());
+    args->Append(tab->ToValue());
 
     DispatchEventToExtension(web_contents->GetBrowserContext(),
                              extension_action.extension_id(), histogram_value,
                              event_name, std::move(args));
   }
 }
 
 void ExtensionActionAPI::ClearAllValuesForTab(
     content::WebContents* web_contents) {
   DCHECK(web_contents);
@@ skipping 374 matching lines @@
   if (host->extension_host_type() != VIEW_TYPE_EXTENSION_POPUP ||
       host->extension()->id() != extension_->id())
     return;
 
   SendResponse(true);
   response_sent_ = true;
   registrar_.RemoveAll();
 }
 
 }  // namespace extensions