Restrict Google Now URL Permissions

chrome/browser/resources/google_now/manifest.json

 {
   //chrome-extension://pafkbggdmjlpgkdkcbjmhmfcdpncadgh
   "name": "Google Now",
   "version": "1.2.0.1",
   "description": "Integrates Google Now into Chrome.",
   "icons": {
     "16": "images/icon16.png",
     "48": "images/icon48.png",
     "128": "images/icon128.png"
   },
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkhqJr32OFD/bMXW4Md7jMfd7LbwHXVc6x5bBQG5U+dloofoxrICDR20yur/40mQ8O//0sS1b8srvbab1CRlSrxoNCr9T80NAkfzx0gHyVS+p1Zow+1FzLMu9PiGwwFyN80HIB7GI/dIa0wC9K/2OrrzcHEhVH96DacTtWQqjfDVtZPjT7Xwv23dgoWcpbkRC86jMJot3dmX9xnn0KzoVc9gDOHSIkBLbkkr6Sp3LGXCCM4L0DJgxdFwaLr5WBzgC3y5x0/wwPIwN4PtIaK3BhH6njlksfnKwwIJ9iRT41V4BqbWu4mszO/7VJ3HJyw2DBpIc2grU9ZRRxrV3fRQG4wIDAQAB",
   "permissions": [
     "alarms",
     "identity",
     "metricsPrivate",
     "notifications",
     "pushMessaging",
     "storage",
     "tabs",
     "webstorePrivate",
-    // TODO(vadimt): Replace <all_urls> with real URL patterns once we know
-    // them.
-    "<all_urls>"
+    "*://*.google.com/*",

[skare_, 2014/05/29 18:28:53]

overall I'd be more worried about blocking something with this CL, but we have a
few weeks for bugs to pop up -- so on the other hand, could this line be made
more narrow?

[robliao, 2014/05/29 18:53:50]

Issue discussed.
On 2014/05/29 18:28:53, Travis Skare wrote:

+    "*://*.gstatic.com/*",
+    "https://*.googleapis.com/chromenow/v1/*",
+    "https://*.googleusercontent.com/*"

[rgustafson, 2014/05/29 17:30:01]

Did you find something that suggested that restaurant/hotel/etc cards would only
be from one of those listed?

What's the failure mode if we get this wrong? Will we get a jserror report?

[robliao, 2014/05/29 17:35:19]

Nope. The images I got back from my tests are either direct data or links to
googleusercontent (G+, Frequent Places, Maps).

The current failure mode is to log an error to the console. Once we do a test
pass on this, it should be clear what works and doesn't work.

On 2014/05/29 17:30:01, rgustafson wrote:

   ],
   "optional_permissions": ["background"],
   "manifest_version": 2,
   "background": {
     "scripts": ["utility.js", "cards.js", "background.js"],
     "persistent": false
   },
   "oauth2": {
     "auto_approve": true,
     "scopes": ["https://www.googleapis.com/auth/googlenow"]
   }
 }