Fixes and improvements to cloud policy for extensions.

chrome/browser/policy/cloud/component_cloud_policy_service.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/cloud/component_cloud_policy_service.h"
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 127 matching lines @@
   }
 }
 
 void ComponentCloudPolicyService::Backend::Init(
     scoped_refptr<SchemaMap> schema_map) {
   DCHECK(!schema_map_);
 
   OnSchemasUpdated(schema_map, scoped_ptr<PolicyNamespaceList>());
 
   // Read the initial policy. Note that this does not trigger notifications
-  // through OnComponentCloudPolicyStoreUpdated.
+  // through OnComponentCloudPolicyStoreUpdated. Note also that the cached
+  // data may contain names or values that don't match the schema for that
+  // component; the data must be cached without modifications so that its
+  // integrity can be verified using the hash, but it must also be filtered
+  // right after a Load().
   store_.Load();
   scoped_ptr<PolicyBundle> bundle(new PolicyBundle);
   bundle->CopyFrom(store_.policy());
+  schema_map_->FilterBundle(bundle.get());
 
   // Start downloading any pending data.
   updater_.reset(new ComponentCloudPolicyUpdater(
       task_runner_, external_policy_data_fetcher_.Pass(), &store_));
 
   service_task_runner_->PostTask(
       FROM_HERE,
       base::Bind(&ComponentCloudPolicyService::OnBackendInitialized,
                  service_,
                  base::Passed(&bundle)));
@@ skipping 325 matching lines @@
 }
 
 void ComponentCloudPolicyService::OnPolicyUpdated(
     scoped_ptr<PolicyBundle> policy) {
   DCHECK(CalledOnValidThread());
   policy_.Swap(policy.get());
   delegate_->OnComponentCloudPolicyUpdated();
 }
 
 }  // namespace policy