Track permissions granted to extensions in prefs

chrome/browser/extensions/extensions_service.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extensions_service.h"
 
 #include <algorithm>
 
 #include "base/basictypes.h"
 #include "base/command_line.h"
@@ skipping 329 matching lines @@
 
   if (!extension) {
     ReportExtensionLoadError(extension_path, error);
     return;
   }
 
   // Report this as an installed extension so that it gets remembered in the
   // prefs.
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
-      NewRunnableMethod(frontend_, &ExtensionsService::OnExtensionInstalled,
-                        extension, true));
+      NewRunnableMethod(frontend_,
+                        &ExtensionsService::OnExtensionInstalled,
+                        extension));
 }
 
 void ExtensionsServiceBackend::ReportExtensionLoadError(
     const FilePath& extension_path, const std::string &error) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       NewRunnableMethod(
           frontend_,
           &ExtensionsService::ReportExtensionLoadError, extension_path,
@@ skipping 275 matching lines @@
   CheckForExternalUpdates();
 
   // TODO(erikkay) this should probably be deferred as well.
   GarbageCollectExtensions();
 }
 
 void ExtensionsService::InstallExtension(const FilePath& extension_path) {
   scoped_refptr<CrxInstaller> installer(
       new CrxInstaller(this,  // frontend
                        NULL));  // no client (silent install)
-  installer->set_allow_privilege_increase(true);
   installer->InstallCrx(extension_path);
 }
 
 namespace {
   // TODO(akalin): Put this somewhere where both crx_installer.cc and
   // this file can use it.
   void DeleteFileHelper(const FilePath& path, bool recursive) {
     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
     file_util::Delete(path, recursive);
   }
@@ skipping 278 matching lines @@
                                            extension);
   extensions_.erase(iter);
 
   ExtensionDOMUI::UnregisterChromeURLOverrides(profile_,
       extension->GetChromeURLOverrides());
 
   NotifyExtensionUnloaded(extension);
   UpdateActiveExtensionsInCrashReporter();
 }
 
+void ExtensionsService::GrantPermissions(const Extension* extension) {
+  CHECK(extension);
+
+  // We only maintain the granted permissions prefs for INTERNAL extensions.
+  CHECK(extension->location() == Extension::INTERNAL);
+
+  ExtensionExtent effective_hosts = extension->GetEffectiveHostPermissions();
+  extension_prefs_->AddGrantedPermissions(extension->id(),
+                                          extension->HasFullPermissions(),
+                                          extension->api_permissions(),
+                                          effective_hosts);
+}
+
+void ExtensionsService::GrantPermissionsAndEnableExtension(
+    const Extension* extension) {
+  CHECK(extension);
+  GrantPermissions(extension);
+  extension_prefs_->SetDidExtensionEscalatePermissions(extension, false);
+  EnableExtension(extension->id());
+}
+
 void ExtensionsService::LoadExtension(const FilePath& extension_path) {
   BrowserThread::PostTask(
       BrowserThread::FILE, FROM_HERE,
       NewRunnableMethod(
           backend_.get(),
           &ExtensionsServiceBackend::LoadSingleExtension,
           extension_path, scoped_refptr<ExtensionsService>(this)));
 }
 
 void ExtensionsService::LoadComponentExtensions() {
@@ skipping 12 matching lines @@
         it->root_directory,
         Extension::COMPONENT,
         *static_cast<DictionaryValue*>(manifest.get()),
         true,  // require key
         &error));
     if (!extension.get()) {
       NOTREACHED() << error;
       return;
     }
 
-    OnExtensionLoaded(extension, false);  // Don't allow privilege increase.
+    OnExtensionLoaded(extension);
   }
 }
 
 void ExtensionsService::LoadAllExtensions() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   base::TimeTicks start_time = base::TimeTicks::Now();
 
   // Load any component extensions.
   LoadComponentExtensions();
@@ skipping 124 matching lines @@
   UMA_HISTOGRAM_COUNTS_100("Extensions.LoadPackagedApp", packaged_app_count);
   UMA_HISTOGRAM_COUNTS_100("Extensions.LoadExtension", extension_count);
   UMA_HISTOGRAM_COUNTS_100("Extensions.LoadUserScript", user_script_count);
   UMA_HISTOGRAM_COUNTS_100("Extensions.LoadTheme", theme_count);
   UMA_HISTOGRAM_COUNTS_100("Extensions.LoadExternal", external_count);
   UMA_HISTOGRAM_COUNTS_100("Extensions.LoadPageAction", page_action_count);
   UMA_HISTOGRAM_COUNTS_100("Extensions.LoadBrowserAction",
                            browser_action_count);
 }
 
-
 void ExtensionsService::LoadInstalledExtension(const ExtensionInfo& info,
                                                bool write_to_prefs) {
   std::string error;
   scoped_refptr<const Extension> extension(NULL);
   if (!extension_prefs_->IsExtensionAllowedByPolicy(info.extension_id)) {
     error = errors::kDisabledByPolicy;
   } else if (info.extension_manifest.get()) {
     bool require_key = info.extension_location != Extension::LOAD;
     extension = Extension::Create(
         info.extension_path, info.extension_location, *info.extension_manifest,
         require_key, &error);
   } else {
     error = errors::kManifestUnreadable;
   }
 
   if (!extension) {
     ReportExtensionLoadError(info.extension_path,
                              error,
                              NotificationType::EXTENSION_INSTALL_ERROR,
                              false);
     return;
   }
 
   if (write_to_prefs)
     extension_prefs_->UpdateManifest(extension);
 
-  OnExtensionLoaded(extension, true);
+  OnExtensionLoaded(extension);
 
   if (Extension::IsExternalLocation(info.extension_location)) {
     BrowserThread::PostTask(
         BrowserThread::FILE, FROM_HERE,
         NewRunnableMethod(
             backend_.get(),
             &ExtensionsServiceBackend::CheckExternalUninstall,
             scoped_refptr<ExtensionsService>(this),
             info.extension_id));
   }
@@ skipping 355 matching lines @@
     updater_->Start();
   }
 
   ready_ = true;
   NotificationService::current()->Notify(
       NotificationType::EXTENSIONS_READY,
       Source<Profile>(profile_),
       NotificationService::NoDetails());
 }
 
-void ExtensionsService::OnExtensionLoaded(const Extension* extension,
-                                          bool allow_privilege_increase) {
+void ExtensionsService::OnExtensionLoaded(const Extension* extension) {
   // Ensure extension is deleted unless we transfer ownership.
   scoped_refptr<const Extension> scoped_extension(extension);
 
   // The extension is now loaded, remove its data from unloaded extension map.
   unloaded_extension_paths_.erase(extension->id());
 
   // If the extension was disabled for a reload, then enable it.
   if (disabled_extension_paths_.erase(extension->id()) > 0)
     EnableExtension(extension->id());
 
-  // TODO(aa): Need to re-evaluate this branch. Does this still make sense now
-  // that extensions are enabled by default?
-  if (extensions_enabled() ||
-      extension->is_theme() ||
-      extension->location() == Extension::LOAD ||
-      extension->location() == Extension::COMPONENT ||
-      Extension::IsExternalLocation(extension->location())) {
-    const Extension* old = GetExtensionByIdInternal(extension->id(),
-                                                    true, true);
-    if (old) {
-      // CrxInstaller should have guaranteed that we aren't downgrading.
-      CHECK(extension->version()->CompareTo(*(old->version())) >= 0);
+  // Check if the extension's privileges have changed and disable the extension
+  // if necessary.
+  DisableIfPrivilegeIncrease(extension);
 
-      bool allow_silent_upgrade =
-          allow_privilege_increase || !Extension::IsPrivilegeIncrease(
-              old, extension);
+  switch (extension_prefs_->GetExtensionState(extension->id())) {
+    case Extension::ENABLED:
+      extensions_.push_back(scoped_extension);
 
-      // Extensions get upgraded if silent upgrades are allowed, otherwise
-      // they get disabled.
-      if (allow_silent_upgrade) {
-        SetBeingUpgraded(old, true);
-        SetBeingUpgraded(extension, true);
-      }
+      NotifyExtensionLoaded(extension);
 
-      // To upgrade an extension in place, unload the old one and
-      // then load the new one.
-      UnloadExtension(old->id());
-      old = NULL;
-
-      if (!allow_silent_upgrade) {
-        // Extension has changed permissions significantly. Disable it. We
-        // send a notification below.
-        extension_prefs_->SetExtensionState(extension, Extension::DISABLED);
-        extension_prefs_->SetDidExtensionEscalatePermissions(extension, true);
-      }
-    }
-
-    switch (extension_prefs_->GetExtensionState(extension->id())) {
-      case Extension::ENABLED:
-        extensions_.push_back(scoped_extension);
-
-        NotifyExtensionLoaded(extension);
-
-        ExtensionDOMUI::RegisterChromeURLOverrides(profile_,
-            extension->GetChromeURLOverrides());
-        break;
-      case Extension::DISABLED:
-        disabled_extensions_.push_back(scoped_extension);
-        NotificationService::current()->Notify(
-            NotificationType::EXTENSION_UPDATE_DISABLED,
-            Source<Profile>(profile_),
-            Details<const Extension>(extension));
-        break;
-      default:
-        NOTREACHED();
-        break;
-    }
+      ExtensionDOMUI::RegisterChromeURLOverrides(
+          profile_, extension->GetChromeURLOverrides());
+      break;
+    case Extension::DISABLED:
+      disabled_extensions_.push_back(scoped_extension);
+      NotificationService::current()->Notify(
+          NotificationType::EXTENSION_UPDATE_DISABLED,
+          Source<Profile>(profile_),
+          Details<const Extension>(extension));
+      break;
+    default:
+      NOTREACHED();
+      break;
   }
 
   SetBeingUpgraded(extension, false);
 
   UpdateActiveExtensionsInCrashReporter();
 
   if (profile_->GetTemplateURLModel())
     profile_->GetTemplateURLModel()->RegisterExtensionKeyword(extension);
 
   // Load the icon for omnibox-enabled extensions so it will be ready to display
   // in the URL bar.
   if (!extension->omnibox_keyword().empty()) {
     omnibox_popup_icon_manager_.LoadIcon(extension);
     omnibox_icon_manager_.LoadIcon(extension);
   }
 }
 
+void ExtensionsService::DisableIfPrivilegeIncrease(const Extension* extension) {
+  // We keep track of all permissions the user has granted each extension.
+  // This allows extensions to gracefully support backwards compatibility
+  // by including unknown permissions in their manifests. When the user
+  // installs the extension, only the recognized permissions are recorded.
+  // When the unknown permissions become recognized (e.g., through browser
+  // upgrade), we can prompt the user to accept these new permissions.
+  // Extensions can also silently upgrade to less permissions, and then
+  // silently upgrade to a version that adds these permissions back.
+  //
+  // For example, pretend that Chrome 10 includes a permission "omnibox"
+  // for an API that adds suggestions to the omnibox. An extension can
+  // maintain backwards compatibility while still having "omnibox" in the
+  // manifest. If a user installs the extension on Chrome 9, the browser
+  // will record the permissions it recognized, not including "omnibox."
+  // When upgrading to Chrome 10, "omnibox" will be recognized and Chrome
+  // will disable the extension and prompt the user to approve the increase
+  // in privileges. The extension could then release a new version that
+  // removes the "omnibox" permission. When the user upgrades, Chrome will
+  // still remember that "omnibox" had been granted, so that if the
+  // extension once again includes "omnibox" in an upgrade, the extension
+  // can upgrade without requiring this user's approval.
+  const Extension* old = GetExtensionByIdInternal(extension->id(),
+                                                  true, true);
+  bool granted_full_access;
+  std::set<std::string> granted_apis;
+  ExtensionExtent granted_extent;
+
+  bool is_extension_upgrade = old != NULL;
+  bool is_privilege_increase = false;
+
+  // We only record the granted permissions for INTERNAL extensions, since
+  // they can't silently increase privileges.
+  if (extension->location() == Extension::INTERNAL) {
+    // Add all the recognized permissions if the granted permissions list
+    // hasn't been initialized yet.
+    if (!extension_prefs_->GetGrantedPermissions(extension->id(),
+                                                 &granted_full_access,
+                                                 &granted_apis,
+                                                 &granted_extent)) {
+      GrantPermissions(extension);
+      CHECK(extension_prefs_->GetGrantedPermissions(extension->id(),
+                                                    &granted_full_access,
+                                                    &granted_apis,
+                                                    &granted_extent));
+    }
+
+    // Here, we check if an extension's privileges have increased in a manner
+    // that requires the user's approval. This could occur because the browser
+    // upgraded and recognized additional privileges, or an extension upgrades
+    // to a version that requires additional privileges.
+    is_privilege_increase = Extension::IsPrivilegeIncrease(
+        granted_full_access, granted_apis, granted_extent, extension);
+  }
+
+  if (is_extension_upgrade) {
+    // CrxInstaller should have guaranteed that we aren't downgrading.
+    CHECK(extension->version()->CompareTo(*(old->version())) >= 0);
+
+    // Extensions get upgraded if the privileges are allowed to increase or
+    // the privileges haven't increased.
+    if (!is_privilege_increase) {
+      SetBeingUpgraded(old, true);
+      SetBeingUpgraded(extension, true);
+    }
+
+    // To upgrade an extension in place, unload the old one and
+    // then load the new one.
+    UnloadExtension(old->id());
+    old = NULL;
+  }
+
+  // Extension has changed permissions significantly. Disable it. A
+  // notification should be sent by the caller.
+  if (is_privilege_increase) {
+    extension_prefs_->SetExtensionState(extension, Extension::DISABLED);
+    extension_prefs_->SetDidExtensionEscalatePermissions(extension, true);
+  }
+}
+
 void ExtensionsService::UpdateActiveExtensionsInCrashReporter() {
   std::set<std::string> extension_ids;
   for (size_t i = 0; i < extensions_.size(); ++i) {
     if (!extensions_[i]->is_theme() &&
         extensions_[i]->location() != Extension::COMPONENT)
       extension_ids.insert(extensions_[i]->id());
   }
 
   child_process_logging::SetActiveExtensions(extension_ids);
 }
 
-void ExtensionsService::OnExtensionInstalled(const Extension* extension,
-                                             bool allow_privilege_increase) {
+void ExtensionsService::OnExtensionInstalled(const Extension* extension) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   // Ensure extension is deleted unless we transfer ownership.
   scoped_refptr<const Extension> scoped_extension(extension);
   Extension::State initial_state = Extension::DISABLED;
   bool initial_enable_incognito = false;
   PendingExtensionMap::iterator it =
       pending_extensions_.find(extension->id());
   if (it != pending_extensions_.end()) {
     PendingExtensionInfo pending_extension_info = it->second;
@@ skipping 121 matching lines @@
         Details<const Extension>(extension));
   }
 
   if (extension->is_app()) {
     ExtensionIdSet installed_ids = GetAppIds();
     installed_ids.insert(extension->id());
     default_apps_.DidInstallApp(installed_ids);
   }
 
   // Transfer ownership of |extension| to OnExtensionLoaded.
-  OnExtensionLoaded(scoped_extension, allow_privilege_increase);
+  OnExtensionLoaded(scoped_extension);
 }
 
 const Extension* ExtensionsService::GetExtensionByIdInternal(
     const std::string& id, bool include_enabled, bool include_disabled) {
   std::string lowercase_id = StringToLowerASCII(id);
   if (include_enabled) {
     for (ExtensionList::const_iterator iter = extensions_.begin();
         iter != extensions_.end(); ++iter) {
       if ((*iter)->id() == lowercase_id)
         return *iter;
@@ skipping 97 matching lines @@
                      << "is: " << version << ". Keeping current version.";
         return;
     }
   }
 
   scoped_refptr<CrxInstaller> installer(
       new CrxInstaller(this,  // frontend
                        NULL));  // no client (silent install)
   installer->set_install_source(location);
   installer->set_expected_id(id);
-  installer->set_allow_privilege_increase(true);
   installer->InstallCrx(path);
 }
 
 void ExtensionsService::ReportExtensionLoadError(
     const FilePath& extension_path,
     const std::string &error,
     NotificationType type,
     bool be_noisy) {
   NotificationService* service = NotificationService::current();
   service->Notify(type,
@@ skipping 96 matching lines @@
 }
 
 void ExtensionsService::SetBeingUpgraded(const Extension* extension,
                                          bool value) {
   extension_runtime_data_[extension->id()].being_upgraded = value;
 }
 
 PropertyBag* ExtensionsService::GetPropertyBag(const Extension* extension) {
   return &extension_runtime_data_[extension->id()].property_bag;
 }