Remove the "content_script" context from a number of APIs that shouldn't be

extensions/common/api/_api_features.json

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This features file defines extension APIs implemented under src/extensions.
 // See extensions/common/features/* to understand this file, in particular
 // feature.h, simple_feature.h, and base_feature_provider.h.
 //
 // Note that specifying "web_page", "blessed_web_page", or "all" as a context
 // type will require manually updating chrome/renderer/resources/dispatcher.cc.
@@ skipping 55 matching lines @@
     "contexts": "all",
     "extension_types": "all",
     "matches": ["<all_urls>"]
   },
   "runtime.onConnect": {
     "contexts": ["blessed_extension", "unblessed_extension", "content_script"]
   },
   "runtime.onMessage": {
     "contexts": ["blessed_extension", "unblessed_extension", "content_script"]
   },
-  "runtime.reload": {
-    "contexts": ["blessed_extension", "unblessed_extension", "content_script"]
-  },
-  "runtime.requestUpdateCheck": {
-    "contexts": ["blessed_extension", "unblessed_extension", "content_script"]
-  },

[not at google - send to devlin, 2014/07/09 03:06:54]

I will need to send out a PSA to the extensions mailing list about these
changes.

[asargent_no_longer_on_chrome, 2014/07/09 18:09:47]

Is there a downside to allowing runtime.reload and runtime.requestUpdateCheck to
be called from content scripts? Anything worse than just potential Denial Of
Service attacks if attacker-controlled script ran in the content script's world?

[not at google - send to devlin, 2014/07/09 18:14:25]

I think anything that only makes sense to be mediated from a single choke point
should be in the background page?

[not at google - send to devlin, 2014/07/09 20:59:24]

We've never documented it as being available in content scripts, and I don't
want to document it as such of course. We could always write code to hide those
functions from appearing in that list I suppose, and then add UMA to track when
they're being called. I'm not having much luck on codesearch.

   "runtime.sendMessage": {
     "contexts": "all",
     "matches": ["<all_urls>"]
   },
   "runtime.setUninstallURL": {
-    "channel": "dev",
-    "contexts": ["blessed_extension", "unblessed_extension", "content_script"]
+    "channel": "dev"
   },
   "socket": {
     "dependencies": ["permission:socket"],
     "contexts": ["blessed_extension"]
   },
   "sockets.tcp": {
     "dependencies": ["manifest:sockets"],
     "contexts": ["blessed_extension"]
   },
   "sockets.tcpServer": {
@@ skipping 22 matching lines @@
   "types.private": {
     "channel": "dev",
     "extension_types": ["extension"],
     "location": "component"
   },
   "usb": {
     "dependencies": ["permission:usb"],
     "contexts": ["blessed_extension"]
   }
 }