Restrict Google Now URL Permissions

chrome/browser/resources/google_now/manifest.json

Index: chrome/browser/resources/google_now/manifest.json
diff --git a/chrome/browser/resources/google_now/manifest.json b/chrome/browser/resources/google_now/manifest.json
index 8ee0ae244008a7158883aadb24080ecb9d3a6471..1eb6e9111076150bc34740b611115f068e6e2da9 100644
--- a/chrome/browser/resources/google_now/manifest.json
+++ b/chrome/browser/resources/google_now/manifest.json
@@ -18,9 +18,10 @@
     "storage",
     "tabs",
     "webstorePrivate",
-    // TODO(vadimt): Replace <all_urls> with real URL patterns once we know
-    // them.
-    "<all_urls>"
+    "*://*.google.com/*",

[skare_, 2014/05/29 18:28:53]

overall I'd be more worried about blocking something with this CL, but we have a
few weeks for bugs to pop up -- so on the other hand, could this line be made
more narrow?

[robliao, 2014/05/29 18:53:50]

Issue discussed.
On 2014/05/29 18:28:53, Travis Skare wrote:

+    "*://*.gstatic.com/*",
+    "https://*.googleapis.com/chromenow/v1/*",
+    "https://*.googleusercontent.com/*"

[rgustafson, 2014/05/29 17:30:01]

Did you find something that suggested that restaurant/hotel/etc cards would only
be from one of those listed?

What's the failure mode if we get this wrong? Will we get a jserror report?

[robliao, 2014/05/29 17:35:19]

Nope. The images I got back from my tests are either direct data or links to
googleusercontent (G+, Frequent Places, Maps).

The current failure mode is to log an error to the console. Once we do a test
pass on this, it should be clear what works and doesn't work.

On 2014/05/29 17:30:01, rgustafson wrote:

   ],
   "optional_permissions": ["background"],
   "manifest_version": 2,