Use sha hashes of extension ids to whitelist.

chrome/browser/resources/feedback/js/event_handler.js

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @type {number}
  * @const
  */
 var FEEDBACK_WIDTH = 500;
 /**
  * @type {number}
  * @const
  */
 var FEEDBACK_HEIGHT = 585;
 
 var initialFeedbackInfo = null;
 
+// To generate a hashed extension ID, use a sha-256 hash, all in lower case.
+// Example:
+//   echo -n 'abcdefghijklmnopqrstuvwxyzabcdef' | sha256sum | awk '{print $1}'
 var whitelistedExtensionIds = [
-  'bpmcpldpdmajfigpchkicefoigmkfalc', // QuickOffice
-  'ehibbfinohgbchlgdbfpikodjaojhccn', // QuickOffice
-  'gbkeegbaiigmenfmjfclcdgdpimamgkj', // QuickOffice
-  'efjnaogkjbogokcnohkmnjdojkikgobo', // G+ Photos
-  'ebpbnabdhheoknfklmpddcdijjkmklkp', // G+ Photos
-  'endkpmfloggdajndjpoekmkjnkolfdbf', // Feedback Extension
-  'mlocfejafidcakdddnndjdngfmncfbeg', // Connectivity Diagnostics
-  'ganomidahfnpdchomfgdoppjmmedlhia', // Connectivity Diagnostics
-  'eemlkeanncmjljgehlbplemhmdmalhdc', // Connectivity Diagnostics
-  'kodldpbjkkmmnilagfdheibampofhaom', // Connectivity Diagnostics
-  'kkebgepbbgbcmghedmmdfcbdcodlkngh', // Chrome OS Recovery Tool
-  'jndclpdbaamdhonoechobihbbiimdgai', // Chrome OS Recovery Tool
-  'ljoammodoonkhnehlncldjelhidljdpi', // GetHelp app.
-  'ljacajndfccfgnfohlgkdphmbnpkjflk', // Chrome Remote Desktop Dev
-  'gbchcmhmhahfdphkhkmpfmihenigjmpp', // Chrome Remote Desktop Stable
-  'odkaodonbgfohohmklejpjiejmcipmib', // Chrome Remote Desktop QA
-  'dokpleeekgeeiehdhmdkeimnkmoifgdd', // Chrome Remote Desktop QA backup
-  'ajoainacpilcemgiakehflpbkbfipojk', // Chrome Remote Desktop Apps V2
-  'llohocloplkbhgcfnplnoficdkiechcn', // Play Movies Dev
-  'icljpnebmoleodmchaaajbkpoipfoahp', // Play Movies Nightly
-  'mjekoljodoiapgkggnlmbecndfpbbcch', // Play Movies Beta
-  'gdijeikdkaembjbdobgfkoidjkpbmlkd', // Play Movies Stable
-  'andfmajejfpjojledngpdaibbhkffipo', // Hangouts Extension
-  'jfjjdfefebklmdbmenmlehlopoocnoeh', // Hangouts Extension
-  'dhcmpocobclokhifdkgcjbnfdaneoojd', // Hangouts Extension
-  'ppleadejekpmccmnpjdimmlfljlkdfej', // Hangouts Extension
-  'eggnbpckecmjlblplehfpjjdhhidfdoj', // Hangouts Extension
-  'ljclpkphhpbpinifbeabbhlfddcpfdde', // Hangouts Extension
-  'nckgahadagoaajjgafhacjanaoiihapd', // Hangouts Extension
-  'knipolnnllmklapflnccelgolnpehhpl', // Hangouts Extension
-  'dogkdgiahcdchbabhdmpbhlfoddjined', // GLS nightly
-  'khkjfddibboofomnlkndfedpoccieiee', // GLS stable
+  '0eeefaa87e292cd986dd0528e90f9128a936b1c4e1c53e7faa0244594c69df94', // QuickOffice

[mednik, 2015/02/20 23:48:03]

This format looks different from that used to whitelist hashes of extensions for
APIs:
https://code.google.com/p/chromium/codesearch#chromium/src/extensions/common/...

It would be really nice if these were the same so app developers who get
whitelisted in that file can just dump the same hashes in here.

[rkc, 2015/02/23 20:03:30]

The current extensions system uses SHA1. I decided to use SHA-256 due to Google
eventually phasing out SHA1 due to insecurity. I spoke with the extension team
about this and it seems that we get enough security with SHA1. If someone really
wants to spend the time to break SHA1 on these IDs, we don't really care that
much. So the decision is to use SHA1.

Done.

+  '04c5c683bdbbda3120fdd1043e96e551185c57f38be14ee17b5993f6ad4c592f', // QuickOffice
+  '5f81f9fe1f4f499490466bc3861653fe72de22e2ba8e4e5769ded9fb2c7ee2d0', // QuickOffice
+  '4d4fc32a4150c7d9f8eb086d4e8b336600932492b84089fbae4f0f54e6c109ca', // G+ Photos
+  '83e306fdc741f89b40f04d53797eb720e5435b2e73fb5c8c3784442512b247c9', // G+ Photos
+  '674b9eabe65d268cd0f2c65e252ae442a09171fcd5d6a10ed9215208289975b2', // Feedback Extension
+  'b95301dd32b3aa23b0d117c32dc45f2e09d6f1664279598a48631e469e0abac9', // Connectivity Diagnostics
+  '33b6334139f225192217454100cc628dc3570dbd34a10a8825345209cf77f719', // Connectivity Diagnostics
+  '6e0b83d8e9a5072ad869622f18f79162c9bf93918fa9e6d6157421aaf37a6f5a', // Connectivity Diagnostics
+  'e34c1ed72d48e4a61c16b69e27b6299ed60f76852d82bd7923ad9d1bd12f3d02', // Connectivity Diagnostics
+  '0716d7e784e7cd26f5aad07b4fb1cb61d5461dd4327b1ab99cc7820b754f0136', // Chrome OS Recovery Tool
+  'e69face7a7e30f74687249987aa339b47816e25a0d9316a3c0a698b02d1ddefc', // Chrome OS Recovery Tool
+  'ee9cc86a9c05427a9c1403aa62fe264720f1f340d1ac0e0cb2cf780afa180023', // GetHelp app.
+  'e703d4328e2d81899dfbeaaafdfb5175af10a3bda050176cb7b9bab352164126', // Chrome Remote Desktop Dev
+  '767c6e409da494634a4e7dd17871c6c6b719d07340c41893742117345d98dd9e', // Chrome Remote Desktop Stable
+  '22b52c2dd867c39b74ba7b8472ff5c27672f6c597045628ba9b0b20062741171', // Chrome Remote Desktop QA
+  '286cbfc2e16a6578815e9c8c17978bfe5629b3737fa154b2ed71d55ffc41cfbd', // Chrome Remote Desktop QA backup
+  '3ccad7148e402a5920ca63077d14de50dda93d347d9e5b4129a711f9bf0d7271', // Chrome Remote Desktop Apps V2
+  'a078d80697a121207e78a41d6b3dabe9545fe5b3ecc91cd221c8f802d0fa304b', // Play Movies Dev
+  '927ed9fcbbedda70b79cccb0f76edb7d36c1e48b1049ff8c2bba78b4ed971d2e', // Play Movies Nightly
+  'eca389c5ef975c1c9e07dfd50c59925d64632c3b09c418e7ecfcba3ada13ca6d', // Play Movies Beta
+  'f203e23f6450b65ef0fd9f6ca4006bded3c77151b567352d99c5ca82714a2b85', // Play Movies Stable
+  'cb57437ae9890149f2631062a2be585eb57296d94ae7d603797cdcba026d0939', // Hangouts Extension
+  'e8486d0e4c57480bf87a3ce500627a67cf47dda03b85872c3b531e17393b2abd', // Hangouts Extension
+  '8ad2bccd6237a721b6a51bce833c38b659188ff98e5f2335c00992e4641b23ee', // Hangouts Extension
+  '686d6216be625dab0bb2bec4834181bdee81ff410639eaa55ce42bce2ca38ff8', // Hangouts Extension
+  '0edec707b34d737e6808c1f49c75a41f85abb123eebf92bc16a4d933fb91c0cb', // Hangouts Extension
+  '8e37e180c80468f45822ecaa66e22f831bcc84f2b169fe815d42d1b4791ea3e1', // Hangouts Extension
+  'ba5a008415c2a50120975b653517565579ecfba2682079eed8b7f5b10d9c79e2', // Hangouts Extension
+  'e902e84eabdc1f3bd51bc2d86326a42575e0e59f0840339a300cf281fb28ad49', // Hangouts Extension
+  'f511aceaf81313f414f84dc0222f280fc3c323b7350e8a233d4bd78c36fdddad', // GLS nightly
+  'a5655706f72a6d3e7a0031b6828ce1f24afebd7144f0d591ccc47b32961a2356', // GLS stable
 ];
 
+
 /**
  * Function to determine whether or not a given extension id is whitelisted to
- * invoke the feedback UI.
+ * invoke the feedback UI. If the extension is whitelisted, the callback to
+ * start the Feedback UI will be called.
  * @param {string} id the id of the sender extension.
- * @return {boolean} Whether or not this sender is whitelisted.
+ * @param {Function} startFeedbackCallback The callback function that will
+ *     will start the feedback UI.
+ * @param {Object} feedbackInfo The feedback info object to pass to the
+ *     start feedback UI callback.
  */
-function senderWhitelisted(id) {
-  return id && whitelistedExtensionIds.indexOf(id) != -1;
+function senderWhitelisted(id, startFeedbackCallback, feedbackInfo) {
+  crypto.subtle.digest('SHA-256', (new TextEncoder).encode(id)).then(

[arv (Not doing code reviews), 2015/02/20 23:28:20]

new TextEncoder().encode(id)

[rkc, 2015/02/23 20:03:30]

Throws an exception when I remove the parenthesis.
"Error in event handler for runtime.onMessageExternal: TypeError: undefined is
not a function
    at senderWhitelisted
(chrome-extension://gfdkimpbcpahaombhbimeihdjnejgicl/js/event_handler.js:69:32)"

+      function(hashBuffer) {
+    var hashString = '';
+    var hashView = new Uint8Array(hashBuffer);
+    for (var i = 0; i < hashView.length; ++i) {
+      var hex = hashView[i].toString(16);
+      hex = '0'.substr(0, 2 - hex.length) + hex;

[arv (Not doing code reviews), 2015/02/20 23:28:20]

No need to muck with substr here.

var n = hashView[i];
hashString += n < 0x10 ? '0' : n.toString(16);

[rkc, 2015/02/23 20:03:30]

Done (with the fixed version).

+      hashString += hex;
+    }
+    if (whitelistedExtensionIds.indexOf(hashString) != -1)
+      startFeedbackCallback(feedbackInfo);
+  });
 }
 
 /**
  * Callback which gets notified once our feedback UI has loaded and is ready to
  * receive its initial feedback info object.
  * @param {Object} request The message request object.
  * @param {Object} sender The sender of the message.
  * @param {function(Object)} sendResponse Callback for sending a response.
  */
 function feedbackReadyHandler(request, sender, sendResponse) {
   if (request.ready) {
     chrome.runtime.sendMessage(
         {sentFromEventPage: true, data: initialFeedbackInfo});
   }
 }
 
 
 /**
  * Callback which gets notified if another extension is requesting feedback.
  * @param {Object} request The message request object.
  * @param {Object} sender The sender of the message.
  * @param {function(Object)} sendResponse Callback for sending a response.
  */
 function requestFeedbackHandler(request, sender, sendResponse) {
-  if (request.requestFeedback && senderWhitelisted(sender.id))
-    startFeedbackUI(request.feedbackInfo);
+  if (request.requestFeedback)
+    senderWhitelisted(sender.id, startFeedbackUI, request.feedbackInfo);
 }
 
 /**
  * Callback which starts up the feedback UI.
  * @param {Object} feedbackInfo Object containing any initial feedback info.
  */
 function startFeedbackUI(feedbackInfo) {
   initialFeedbackInfo = feedbackInfo;
   chrome.app.window.create('html/default.html', {
       frame: 'none',
       id: 'default_window',
       width: FEEDBACK_WIDTH,
       height: FEEDBACK_HEIGHT,
       hidden: true,
       resizable: false },
       function(appWindow) {});
 }
 
 chrome.runtime.onMessage.addListener(feedbackReadyHandler);
 chrome.runtime.onMessageExternal.addListener(requestFeedbackHandler);
 chrome.feedbackPrivate.onFeedbackRequested.addListener(startFeedbackUI);