Prevent inline CRX installs in popup windows.

chrome/browser/extensions/webstore_inline_installer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/webstore_inline_installer.h"
 
 #include "base/strings/stringprintf.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/ui/browser_finder.h"
 #include "content/public/browser/web_contents.h"
 
 using content::WebContents;
 
 namespace extensions {
 
-const char kInvalidWebstoreResponseError[] = "Invalid Chrome Web Store reponse";
+const char kInvalidWebstoreResponseError[] =
+    "Invalid Chrome Web Store response.";
 const char kNoVerifiedSitesError[] =
     "Inline installs can only be initiated for Chrome Web Store items that "
-    "have one or more verified sites";
+    "have one or more verified sites.";
 const char kNotFromVerifiedSitesError[] =
     "Installs can only be initiated by one of the Chrome Web Store item's "
-    "verified sites";
+    "verified sites.";
 const char kInlineInstallSupportedError[] =
     "Inline installation is not supported for this item. The user will be "
     "redirected to the Chrome Web Store.";
+const char kInitiatedFromPopupError[] =
+    "Inline installs can not be initiated from pop-up windows.";
 
 WebstoreInlineInstaller::WebstoreInlineInstaller(
     content::WebContents* web_contents,
     const std::string& webstore_item_id,
     const GURL& requestor_url,
     const Callback& callback)
     : WebstoreStandaloneInstaller(
           webstore_item_id,
           Profile::FromBrowserContext(web_contents->GetBrowserContext()),
           callback),
@@ skipping 84 matching lines @@
   return true;
 }
 
 WebContents* WebstoreInlineInstaller::GetWebContents() const {
   return web_contents();
 }
 
 bool WebstoreInlineInstaller::CheckInlineInstallPermitted(
     const base::DictionaryValue& webstore_data,
     std::string* error) const {
+  Browser* browser = chrome::FindBrowserWithWebContents(web_contents());
+  if (browser && browser->is_type_popup()) {

[Devlin, 2015/02/12 17:18:21]

Under what circumstances can browser be null?  If it can be, do we really want
to proceed with installation?

[meacer, 2015/02/12 21:12:05]

Not sure if it can ever be null, but if it is I agree that the install should
not proceed. I added a DCHECK, we can revisit if we see crashes (that would
indicate there is some bug elsewhere anyways).

+    *error = kInitiatedFromPopupError;
+    return false;
+  }
   // The store may not support inline installs for this item, in which case
   // we open the store-provided redirect URL in a new tab and abort the
   // installation process.
   bool inline_install_not_supported = false;
   if (webstore_data.HasKey(kInlineInstallNotSupportedKey)
       && !webstore_data.GetBoolean(kInlineInstallNotSupportedKey,
                                     &inline_install_not_supported)) {
     *error = kInvalidWebstoreResponseError;
     return false;
   }
   if (inline_install_not_supported) {
     std::string redirect_url;
     if (!webstore_data.GetString(kRedirectUrlKey, &redirect_url)) {
       *error = kInvalidWebstoreResponseError;
       return false;
     }
     web_contents()->OpenURL(
         content::OpenURLParams(
             GURL(redirect_url),
             content::Referrer(web_contents()->GetURL(),
                               blink::WebReferrerPolicyDefault),
             NEW_FOREGROUND_TAB, ui::PAGE_TRANSITION_AUTO_BOOKMARK, false));
     *error = kInlineInstallSupportedError;
     return false;
   }
-
   *error = "";
   return true;
 }
 
 bool WebstoreInlineInstaller::CheckRequestorPermitted(
     const base::DictionaryValue& webstore_data,
     std::string* error) const {
   return IsRequestorPermitted(webstore_data, requestor_url_, error);
 }
 
@@ skipping 49 matching lines @@
     DLOG(WARNING) << "Could not parse " << verified_site_pattern_spec <<
         " as URL pattern " << parse_result;
     return false;
   }
   verified_site_pattern.SetScheme("*");
 
   return verified_site_pattern.MatchesURL(requestor_url);
 }
 
 }  // namespace extensions