Prevent extension sideloading from Windows registry

chrome/browser/extensions/external_provider_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/external_provider_impl.h"
 
 #include <set>
 #include <vector>
 
 #include "base/command_line.h"
@@ skipping 48 matching lines @@
 // Constants for keeping track of extension preferences in a dictionary.
 const char ExternalProviderImpl::kInstallParam[] = "install_parameter";
 const char ExternalProviderImpl::kExternalCrx[] = "external_crx";
 const char ExternalProviderImpl::kExternalVersion[] = "external_version";
 const char ExternalProviderImpl::kExternalUpdateUrl[] = "external_update_url";
 const char ExternalProviderImpl::kIsBookmarkApp[] = "is_bookmark_app";
 const char ExternalProviderImpl::kIsFromWebstore[] = "is_from_webstore";
 const char ExternalProviderImpl::kKeepIfPresent[] = "keep_if_present";
 const char ExternalProviderImpl::kWasInstalledByOem[] = "was_installed_by_oem";
 const char ExternalProviderImpl::kSupportedLocales[] = "supported_locales";
+const char ExternalProviderImpl::kMayBeUntrusted[] = "may_be_untrusted";
 
 ExternalProviderImpl::ExternalProviderImpl(
     VisitorInterface* service,
     const scoped_refptr<ExternalLoader>& loader,
     Profile* profile,
     Manifest::Location crx_location,
     Manifest::Location download_location,
     int creation_flags)
     : crx_location_(crx_location),
       download_location_(download_location),
@@ skipping 118 matching lines @@
         continue;
       }
     }
 
     int creation_flags = creation_flags_;
     bool is_bookmark_app;
     if (extension->GetBoolean(kIsBookmarkApp, &is_bookmark_app) &&
         is_bookmark_app) {
       creation_flags |= Extension::FROM_BOOKMARK;
     }
-    bool is_from_webstore;
+    bool is_from_webstore = false;
     if (extension->GetBoolean(kIsFromWebstore, &is_from_webstore) &&
         is_from_webstore) {
       creation_flags |= Extension::FROM_WEBSTORE;
     }
-    bool keep_if_present;
+    bool keep_if_present = false;
     if (extension->GetBoolean(kKeepIfPresent, &keep_if_present) &&
         keep_if_present && profile_) {
       ExtensionServiceInterface* extension_service =
           ExtensionSystem::Get(profile_)->extension_service();
       const Extension* extension = extension_service ?
           extension_service->GetExtensionById(extension_id, true) : NULL;
       if (!extension) {
         VLOG(1) << "Skip installing (or uninstall) external extension: "
                 << extension_id << " because the extension should be kept "
                 << "only if it is already installed.";
         continue;
       }
     }
-    bool was_installed_by_oem;
+    bool was_installed_by_oem = false;
     if (extension->GetBoolean(kWasInstalledByOem, &was_installed_by_oem) &&
         was_installed_by_oem) {
       creation_flags |= Extension::WAS_INSTALLED_BY_OEM;
     }
+    bool may_be_untrusted = false;
+    if (extension->GetBoolean(kMayBeUntrusted, &may_be_untrusted) &&
+        may_be_untrusted) {
+      creation_flags |= Extension::MAY_BE_UNTRUSTED;
+    }
 
     std::string install_parameter;
     extension->GetString(kInstallParam, &install_parameter);
 
     if (has_external_crx) {
       if (crx_location_ == Manifest::INVALID_LOCATION) {
         LOG(WARNING) << "This provider does not support installing external "
                      << "extensions from crx files.";
         continue;
       }
@@ skipping 326 matching lines @@
             service,
             new ExternalComponentLoader(profile),
             profile,
             Manifest::INVALID_LOCATION,
             Manifest::EXTERNAL_COMPONENT,
             Extension::FROM_WEBSTORE | Extension::WAS_INSTALLED_BY_DEFAULT)));
   }
 }
 
 }  // namespace extensions