Use sha hashes of extension ids to whitelist.

chrome/browser/resources/feedback/js/event_handler.js

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @type {number}
  * @const
  */
 var FEEDBACK_WIDTH = 500;
 /**
  * @type {number}
  * @const
  */
 var FEEDBACK_HEIGHT = 585;
 
 var initialFeedbackInfo = null;
 
+// To generate a hashed extension ID, use a sha-256 hash, all in lower case.
+// Example:
+//   echo -n 'abcdefghijklmnopqrstuvwxyzabcdef' | sha256sum | awk '{print $1}'
 var whitelistedExtensionIds = [
-  'bpmcpldpdmajfigpchkicefoigmkfalc', // QuickOffice
-  'ehibbfinohgbchlgdbfpikodjaojhccn', // QuickOffice
-  'gbkeegbaiigmenfmjfclcdgdpimamgkj', // QuickOffice
-  'efjnaogkjbogokcnohkmnjdojkikgobo', // G+ Photos
-  'ebpbnabdhheoknfklmpddcdijjkmklkp', // G+ Photos
-  'endkpmfloggdajndjpoekmkjnkolfdbf', // Feedback Extension
-  'mlocfejafidcakdddnndjdngfmncfbeg', // Connectivity Diagnostics
-  'ganomidahfnpdchomfgdoppjmmedlhia', // Connectivity Diagnostics
-  'eemlkeanncmjljgehlbplemhmdmalhdc', // Connectivity Diagnostics
-  'kodldpbjkkmmnilagfdheibampofhaom', // Connectivity Diagnostics
-  'kkebgepbbgbcmghedmmdfcbdcodlkngh', // Chrome OS Recovery Tool
-  'jndclpdbaamdhonoechobihbbiimdgai', // Chrome OS Recovery Tool
-  'ljoammodoonkhnehlncldjelhidljdpi', // GetHelp app.
-  'ljacajndfccfgnfohlgkdphmbnpkjflk', // Chrome Remote Desktop Dev
-  'gbchcmhmhahfdphkhkmpfmihenigjmpp', // Chrome Remote Desktop Stable
-  'odkaodonbgfohohmklejpjiejmcipmib', // Chrome Remote Desktop QA
-  'dokpleeekgeeiehdhmdkeimnkmoifgdd', // Chrome Remote Desktop QA backup
-  'ajoainacpilcemgiakehflpbkbfipojk', // Chrome Remote Desktop Apps V2
-  'llohocloplkbhgcfnplnoficdkiechcn', // Play Movies Dev
-  'icljpnebmoleodmchaaajbkpoipfoahp', // Play Movies Nightly
-  'mjekoljodoiapgkggnlmbecndfpbbcch', // Play Movies Beta
-  'gdijeikdkaembjbdobgfkoidjkpbmlkd', // Play Movies Stable
-  'andfmajejfpjojledngpdaibbhkffipo', // Hangouts Extension
-  'jfjjdfefebklmdbmenmlehlopoocnoeh', // Hangouts Extension
-  'dhcmpocobclokhifdkgcjbnfdaneoojd', // Hangouts Extension
-  'ppleadejekpmccmnpjdimmlfljlkdfej', // Hangouts Extension
-  'eggnbpckecmjlblplehfpjjdhhidfdoj', // Hangouts Extension
-  'ljclpkphhpbpinifbeabbhlfddcpfdde', // Hangouts Extension
-  'nckgahadagoaajjgafhacjanaoiihapd', // Hangouts Extension
-  'knipolnnllmklapflnccelgolnpehhpl', // Hangouts Extension
-  'dogkdgiahcdchbabhdmpbhlfoddjined', // GLS nightly
-  'khkjfddibboofomnlkndfedpoccieiee', // GLS stable
+  '0eeefaa87e292cd986dd0528e90f9128a936b1c4e1c53e7faa0244594c69df94', // QuickOffice
+  '04c5c683bdbbda3120fdd1043e96e551185c57f38be14ee17b5993f6ad4c592f', // QuickOffice
+  '5f81f9fe1f4f499490466bc3861653fe72de22e2ba8e4e5769ded9fb2c7ee2d0', // QuickOffice
+  '4d4fc32a4150c7d9f8eb086d4e8b336600932492b84089fbae4f0f54e6c109ca', // G+ Photos
+  '83e306fdc741f89b40f04d53797eb720e5435b2e73fb5c8c3784442512b247c9', // G+ Photos
+  '674b9eabe65d268cd0f2c65e252ae442a09171fcd5d6a10ed9215208289975b2', // Feedback Extension
+  'b95301dd32b3aa23b0d117c32dc45f2e09d6f1664279598a48631e469e0abac9', // Connectivity Diagnostics
+  '33b6334139f225192217454100cc628dc3570dbd34a10a8825345209cf77f719', // Connectivity Diagnostics
+  '6e0b83d8e9a5072ad869622f18f79162c9bf93918fa9e6d6157421aaf37a6f5a', // Connectivity Diagnostics
+  'e34c1ed72d48e4a61c16b69e27b6299ed60f76852d82bd7923ad9d1bd12f3d02', // Connectivity Diagnostics
+  '0716d7e784e7cd26f5aad07b4fb1cb61d5461dd4327b1ab99cc7820b754f0136', // Chrome OS Recovery Tool
+  'e69face7a7e30f74687249987aa339b47816e25a0d9316a3c0a698b02d1ddefc', // Chrome OS Recovery Tool
+  'ee9cc86a9c05427a9c1403aa62fe264720f1f340d1ac0e0cb2cf780afa180023', // GetHelp app.
+  'e703d4328e2d81899dfbeaaafdfb5175af10a3bda050176cb7b9bab352164126', // Chrome Remote Desktop Dev
+  '767c6e409da494634a4e7dd17871c6c6b719d07340c41893742117345d98dd9e', // Chrome Remote Desktop Stable
+  '22b52c2dd867c39b74ba7b8472ff5c27672f6c597045628ba9b0b20062741171', // Chrome Remote Desktop QA
+  '286cbfc2e16a6578815e9c8c17978bfe5629b3737fa154b2ed71d55ffc41cfbd', // Chrome Remote Desktop QA backup
+  '3ccad7148e402a5920ca63077d14de50dda93d347d9e5b4129a711f9bf0d7271', // Chrome Remote Desktop Apps V2
+  'a078d80697a121207e78a41d6b3dabe9545fe5b3ecc91cd221c8f802d0fa304b', // Play Movies Dev
+  '927ed9fcbbedda70b79cccb0f76edb7d36c1e48b1049ff8c2bba78b4ed971d2e', // Play Movies Nightly
+  'eca389c5ef975c1c9e07dfd50c59925d64632c3b09c418e7ecfcba3ada13ca6d', // Play Movies Beta
+  'f203e23f6450b65ef0fd9f6ca4006bded3c77151b567352d99c5ca82714a2b85', // Play Movies Stable
+  'cb57437ae9890149f2631062a2be585eb57296d94ae7d603797cdcba026d0939', // Hangouts Extension
+  'e8486d0e4c57480bf87a3ce500627a67cf47dda03b85872c3b531e17393b2abd', // Hangouts Extension
+  '8ad2bccd6237a721b6a51bce833c38b659188ff98e5f2335c00992e4641b23ee', // Hangouts Extension
+  '686d6216be625dab0bb2bec4834181bdee81ff410639eaa55ce42bce2ca38ff8', // Hangouts Extension
+  '0edec707b34d737e6808c1f49c75a41f85abb123eebf92bc16a4d933fb91c0cb', // Hangouts Extension
+  '8e37e180c80468f45822ecaa66e22f831bcc84f2b169fe815d42d1b4791ea3e1', // Hangouts Extension
+  'ba5a008415c2a50120975b653517565579ecfba2682079eed8b7f5b10d9c79e2', // Hangouts Extension
+  'e902e84eabdc1f3bd51bc2d86326a42575e0e59f0840339a300cf281fb28ad49', // Hangouts Extension
+  'f511aceaf81313f414f84dc0222f280fc3c323b7350e8a233d4bd78c36fdddad', // GLS nightly
+  'a5655706f72a6d3e7a0031b6828ce1f24afebd7144f0d591ccc47b32961a2356', // GLS stable
 ];
 
+
+/**
+ * Convert a string into an array buffer.
+ * @param {string} str The string to convert.
+ * @return {ArrayBuffer} The array buffer containing the string.
+ */
+function StringToArrayBuffer(str) {
+  var buffer = new ArrayBuffer(str.length);

[arv (Not doing code reviews), 2015/02/20 22:05:07]

Use TextEncoder instead.

[rkc, 2015/02/20 22:23:24]

Done.

+
+  var view = new Uint8Array(buffer);
+  for (var i = 0; i < str.length; ++i)
+    view[i] = str.charCodeAt(i);
+
+  return buffer;
+}
+
 /**
  * Function to determine whether or not a given extension id is whitelisted to
- * invoke the feedback UI.
+ * invoke the feedback UI. If the extension is whitelisted, the callback to
+ * start the Feedback UI will be called.
  * @param {string} id the id of the sender extension.
- * @return {boolean} Whether or not this sender is whitelisted.
+ * @param {function} startFeedbackCallback The callback function that will

[arv (Not doing code reviews), 2015/02/20 22:05:07]

Function

[rkc, 2015/02/20 22:23:24]

Done.

+ *     will start the feedback UI.
+ * @param {Object} feedbackInfo The feedback info object to pass to the
+ *     start feedback UI callback.
  */
-function senderWhitelisted(id) {
-  return id && whitelistedExtensionIds.indexOf(id) != -1;
+function senderWhitelisted(id, startFeedbackCallback, feedbackInfo) {
+  crypto.subtle.digest('SHA-256', StringToArrayBuffer(id)).then(
+      function(hashBuffer) {
+    var hashString = '';
+    var hashView = new Uint8Array(hashBuffer);

[arv (Not doing code reviews), 2015/02/20 22:05:07]

and TextDecoder here.

[rkc, 2015/02/20 22:23:24]

I am not converting this back to a string. This needs to be converted into a
hash string (with padding). Is that possible with TextDecoder?

+    for (var i = 0; i < hashView.length; ++i) {
+      var hex = hashView[i].toString(16);
+      hex = '0'.substr(0, 2 - hex.length) + hex;
+      hashString += hex;
+    }
+    if (whitelistedExtensionIds.indexOf(hashString) != -1)
+      startFeedbackCallback(feedbackInfo);
+  });
 }
 
 /**
  * Callback which gets notified once our feedback UI has loaded and is ready to
  * receive its initial feedback info object.
  * @param {Object} request The message request object.
  * @param {Object} sender The sender of the message.
  * @param {function(Object)} sendResponse Callback for sending a response.
  */
 function feedbackReadyHandler(request, sender, sendResponse) {
   if (request.ready) {
     chrome.runtime.sendMessage(
         {sentFromEventPage: true, data: initialFeedbackInfo});
   }
 }
 
 
 /**
  * Callback which gets notified if another extension is requesting feedback.
  * @param {Object} request The message request object.
  * @param {Object} sender The sender of the message.
  * @param {function(Object)} sendResponse Callback for sending a response.
  */
 function requestFeedbackHandler(request, sender, sendResponse) {
-  if (request.requestFeedback && senderWhitelisted(sender.id))
-    startFeedbackUI(request.feedbackInfo);
+  if (request.requestFeedback)
+    senderWhitelisted(sender.id, startFeedbackUI, request.feedbackInfo);
 }
 
 /**
  * Callback which starts up the feedback UI.
  * @param {Object} feedbackInfo Object containing any initial feedback info.
  */
 function startFeedbackUI(feedbackInfo) {
   initialFeedbackInfo = feedbackInfo;
   chrome.app.window.create('html/default.html', {
       frame: 'none',
       id: 'default_window',
       width: FEEDBACK_WIDTH,
       height: FEEDBACK_HEIGHT,
       hidden: true,
       resizable: false },
       function(appWindow) {});
 }
 
 chrome.runtime.onMessage.addListener(feedbackReadyHandler);
 chrome.runtime.onMessageExternal.addListener(requestFeedbackHandler);
 chrome.feedbackPrivate.onFeedbackRequested.addListener(startFeedbackUI);