cros: Pass gaia_auth init params via postMessage.

cros: Pass gaia_auth init params via postMessage.

- Pass gaia auth init params via postMessage instead of URL params;
- Validate message origins on both ends to ensure gaia auth only
  takes params from intended hosting pages and hosting pages only
  send params to gaia_auth;
- Add string data storage to GaiaAuthExtensionLoader;
- Use the string data storage to pass frameURL for switchToFullTab;
- Update CSP in manifests to be more restrictive;
- Clean up unused code in util.js;

BUG=453994
Committed: https://crrev.com/3fb85eb7a52c7c26093acef339432fee3b3eec29
Cr-Commit-Position: refs/heads/master@{#314905}

[xiyuan, 2015-02-04 07:52:20]

xiyuan@chromium.org changed reviewers:
+ yoz@chromium.org, zelidrag@chromium.org

[xiyuan, 2015-02-04 07:52:20]

Suggested split:
yoz: chrome/browser/extensions/*
zel: for everything

Thanks.

[Nikita (slow), 2015-02-04 10:20:19]

nkostylev@chromium.org changed reviewers:
+ nkostylev@chromium.org

[Nikita (slow), 2015-02-04 10:20:20]

cc: Dmitry, Roman

How does this CL affect <webview> version of GAIA on login?

[Dmitry Polukhin, 2015-02-04 12:28:05]

On 2015/02/04 10:20:20, Nikita wrote:
> cc: Dmitry, Roman
> 
> How does this CL affect <webview> version of GAIA on login?

It should be no change for webview based signin because extensions is not used
in this case.

[xiyuan, 2015-02-04 16:26:12]

On 2015/02/04 12:28:05, Dmitry Polukhin wrote:
> On 2015/02/04 10:20:20, Nikita wrote:
> > cc: Dmitry, Roman
> > 
> > How does this CL affect <webview> version of GAIA on login?
> 
> It should be no change for webview based signin because extensions is not used
> in this case.

Right. Webview based signin is not affected since it uses postMessage API with
Gaia directly and bypasses the extension.

I have not put too much thought on SAML support (and keyboard halo for CfM
enrollment) which is probably the last piece we need for the webview story.
Until then, we can decide whether to fully deprecate the extension.

[Yoyo Zhou, 2015-02-04 23:24:16]

chrome/browser/extensions LGTM with nits

https://codereview.chromium.org/902493003/diff/1/chrome/browser/extensions/si...
File chrome/browser/extensions/signin/gaia_auth_extension_loader.h (right):

https://codereview.chromium.org/902493003/diff/1/chrome/browser/extensions/si...
chrome/browser/extensions/signin/gaia_auth_extension_loader.h:34: // Add a
string data for gaia_auth extension. Returns an Id that
nit: this is called "gaia auth" rather than "gaia_auth" elsewhere here. Also,
capitalize as "ID"

https://codereview.chromium.org/902493003/diff/1/chrome/browser/extensions/si...
chrome/browser/extensions/signin/gaia_auth_extension_loader.h:35: // could be
used get the data. All strings are cleared when gaia auth
nit: used to

https://codereview.chromium.org/902493003/diff/1/chrome/browser/extensions/si...
chrome/browser/extensions/signin/gaia_auth_extension_loader.h:39: // Get data
for the given id. Returns true if the data is found and
Be consistent here ("ID")

https://codereview.chromium.org/902493003/diff/1/chrome/browser/extensions/si...
chrome/browser/extensions/signin/gaia_auth_extension_loader.h:67:
DISALLOW_COPY_AND_ASSIGN(GaiaAuthExtensionLoader);
#include "base/macros.h" for this

[xiyuan, 2015-02-05 03:57:13]

New patchsets have been uploaded after l-g-t-m from yoz@chromium.org

[xiyuan, 2015-02-05 03:57:41]

https://codereview.chromium.org/902493003/diff/1/chrome/browser/extensions/si...
File chrome/browser/extensions/signin/gaia_auth_extension_loader.h (right):

https://codereview.chromium.org/902493003/diff/1/chrome/browser/extensions/si...
chrome/browser/extensions/signin/gaia_auth_extension_loader.h:34: // Add a
string data for gaia_auth extension. Returns an Id that
On 2015/02/04 23:24:15, Yoyo Zhou wrote:
> nit: this is called "gaia auth" rather than "gaia_auth" elsewhere here. Also,
> capitalize as "ID"

Done.

https://codereview.chromium.org/902493003/diff/1/chrome/browser/extensions/si...
chrome/browser/extensions/signin/gaia_auth_extension_loader.h:35: // could be
used get the data. All strings are cleared when gaia auth
On 2015/02/04 23:24:16, Yoyo Zhou wrote:
> nit: used to

Done.

https://codereview.chromium.org/902493003/diff/1/chrome/browser/extensions/si...
chrome/browser/extensions/signin/gaia_auth_extension_loader.h:39: // Get data
for the given id. Returns true if the data is found and
On 2015/02/04 23:24:16, Yoyo Zhou wrote:
> Be consistent here ("ID")

Done.

https://codereview.chromium.org/902493003/diff/1/chrome/browser/extensions/si...
chrome/browser/extensions/signin/gaia_auth_extension_loader.h:67:
DISALLOW_COPY_AND_ASSIGN(GaiaAuthExtensionLoader);
On 2015/02/04 23:24:16, Yoyo Zhou wrote:
> #include "base/macros.h" for this

Done.

[zel, 2015-02-05 22:58:15]

lgtm

[xiyuan, 2015-02-05 23:00:40]

The CQ bit was checked by xiyuan@chromium.org

[commit-bot: I haz the power, 2015-02-05 23:01:14]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/902493003/20001

[commit-bot: I haz the power, 2015-02-05 23:05:02]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-02-05 23:06:12]

Patchset 2 (id:??) landed as
https://crrev.com/3fb85eb7a52c7c26093acef339432fee3b3eec29
Cr-Commit-Position: refs/heads/master@{#314905}