Use sha hashes of extension ids to whitelist.

chrome/browser/resources/feedback/js/event_handler.js

Index: chrome/browser/resources/feedback/js/event_handler.js
diff --git a/chrome/browser/resources/feedback/js/event_handler.js b/chrome/browser/resources/feedback/js/event_handler.js
index 8e168cba3294953128aff317ef9ee3d385977834..aa77a7677e8a0aae1e0747191ecef060dfefb74d 100644
--- a/chrome/browser/resources/feedback/js/event_handler.js
+++ b/chrome/browser/resources/feedback/js/event_handler.js
@@ -15,49 +15,68 @@ var FEEDBACK_HEIGHT = 585;
 
 var initialFeedbackInfo = null;
 
+// To generate a hashed extension ID, use a sha-256 hash, all in lower case.
+// Example:
+//   echo -n 'abcdefghijklmnopqrstuvwxyzabcdef' | sha256sum | awk '{print $1}'
 var whitelistedExtensionIds = [
-  'bpmcpldpdmajfigpchkicefoigmkfalc', // QuickOffice
-  'ehibbfinohgbchlgdbfpikodjaojhccn', // QuickOffice
-  'gbkeegbaiigmenfmjfclcdgdpimamgkj', // QuickOffice
-  'efjnaogkjbogokcnohkmnjdojkikgobo', // G+ Photos
-  'ebpbnabdhheoknfklmpddcdijjkmklkp', // G+ Photos
-  'endkpmfloggdajndjpoekmkjnkolfdbf', // Feedback Extension
-  'mlocfejafidcakdddnndjdngfmncfbeg', // Connectivity Diagnostics
-  'ganomidahfnpdchomfgdoppjmmedlhia', // Connectivity Diagnostics
-  'eemlkeanncmjljgehlbplemhmdmalhdc', // Connectivity Diagnostics
-  'kodldpbjkkmmnilagfdheibampofhaom', // Connectivity Diagnostics
-  'kkebgepbbgbcmghedmmdfcbdcodlkngh', // Chrome OS Recovery Tool
-  'jndclpdbaamdhonoechobihbbiimdgai', // Chrome OS Recovery Tool
-  'ljoammodoonkhnehlncldjelhidljdpi', // GetHelp app.
-  'ljacajndfccfgnfohlgkdphmbnpkjflk', // Chrome Remote Desktop Dev
-  'gbchcmhmhahfdphkhkmpfmihenigjmpp', // Chrome Remote Desktop Stable
-  'odkaodonbgfohohmklejpjiejmcipmib', // Chrome Remote Desktop QA
-  'dokpleeekgeeiehdhmdkeimnkmoifgdd', // Chrome Remote Desktop QA backup
-  'ajoainacpilcemgiakehflpbkbfipojk', // Chrome Remote Desktop Apps V2
-  'llohocloplkbhgcfnplnoficdkiechcn', // Play Movies Dev
-  'icljpnebmoleodmchaaajbkpoipfoahp', // Play Movies Nightly
-  'mjekoljodoiapgkggnlmbecndfpbbcch', // Play Movies Beta
-  'gdijeikdkaembjbdobgfkoidjkpbmlkd', // Play Movies Stable
-  'andfmajejfpjojledngpdaibbhkffipo', // Hangouts Extension
-  'jfjjdfefebklmdbmenmlehlopoocnoeh', // Hangouts Extension
-  'dhcmpocobclokhifdkgcjbnfdaneoojd', // Hangouts Extension
-  'ppleadejekpmccmnpjdimmlfljlkdfej', // Hangouts Extension
-  'eggnbpckecmjlblplehfpjjdhhidfdoj', // Hangouts Extension
-  'ljclpkphhpbpinifbeabbhlfddcpfdde', // Hangouts Extension
-  'nckgahadagoaajjgafhacjanaoiihapd', // Hangouts Extension
-  'knipolnnllmklapflnccelgolnpehhpl', // Hangouts Extension
-  'dogkdgiahcdchbabhdmpbhlfoddjined', // GLS nightly
-  'khkjfddibboofomnlkndfedpoccieiee', // GLS stable
+  '0eeefaa87e292cd986dd0528e90f9128a936b1c4e1c53e7faa0244594c69df94', // QuickOffice

[mednik, 2015/02/20 23:48:03]

This format looks different from that used to whitelist hashes of extensions for
APIs:
https://code.google.com/p/chromium/codesearch#chromium/src/extensions/common/...

It would be really nice if these were the same so app developers who get
whitelisted in that file can just dump the same hashes in here.

[rkc, 2015/02/23 20:03:30]

The current extensions system uses SHA1. I decided to use SHA-256 due to Google
eventually phasing out SHA1 due to insecurity. I spoke with the extension team
about this and it seems that we get enough security with SHA1. If someone really
wants to spend the time to break SHA1 on these IDs, we don't really care that
much. So the decision is to use SHA1.

Done.

+  '04c5c683bdbbda3120fdd1043e96e551185c57f38be14ee17b5993f6ad4c592f', // QuickOffice
+  '5f81f9fe1f4f499490466bc3861653fe72de22e2ba8e4e5769ded9fb2c7ee2d0', // QuickOffice
+  '4d4fc32a4150c7d9f8eb086d4e8b336600932492b84089fbae4f0f54e6c109ca', // G+ Photos
+  '83e306fdc741f89b40f04d53797eb720e5435b2e73fb5c8c3784442512b247c9', // G+ Photos
+  '674b9eabe65d268cd0f2c65e252ae442a09171fcd5d6a10ed9215208289975b2', // Feedback Extension
+  'b95301dd32b3aa23b0d117c32dc45f2e09d6f1664279598a48631e469e0abac9', // Connectivity Diagnostics
+  '33b6334139f225192217454100cc628dc3570dbd34a10a8825345209cf77f719', // Connectivity Diagnostics
+  '6e0b83d8e9a5072ad869622f18f79162c9bf93918fa9e6d6157421aaf37a6f5a', // Connectivity Diagnostics
+  'e34c1ed72d48e4a61c16b69e27b6299ed60f76852d82bd7923ad9d1bd12f3d02', // Connectivity Diagnostics
+  '0716d7e784e7cd26f5aad07b4fb1cb61d5461dd4327b1ab99cc7820b754f0136', // Chrome OS Recovery Tool
+  'e69face7a7e30f74687249987aa339b47816e25a0d9316a3c0a698b02d1ddefc', // Chrome OS Recovery Tool
+  'ee9cc86a9c05427a9c1403aa62fe264720f1f340d1ac0e0cb2cf780afa180023', // GetHelp app.
+  'e703d4328e2d81899dfbeaaafdfb5175af10a3bda050176cb7b9bab352164126', // Chrome Remote Desktop Dev
+  '767c6e409da494634a4e7dd17871c6c6b719d07340c41893742117345d98dd9e', // Chrome Remote Desktop Stable
+  '22b52c2dd867c39b74ba7b8472ff5c27672f6c597045628ba9b0b20062741171', // Chrome Remote Desktop QA
+  '286cbfc2e16a6578815e9c8c17978bfe5629b3737fa154b2ed71d55ffc41cfbd', // Chrome Remote Desktop QA backup
+  '3ccad7148e402a5920ca63077d14de50dda93d347d9e5b4129a711f9bf0d7271', // Chrome Remote Desktop Apps V2
+  'a078d80697a121207e78a41d6b3dabe9545fe5b3ecc91cd221c8f802d0fa304b', // Play Movies Dev
+  '927ed9fcbbedda70b79cccb0f76edb7d36c1e48b1049ff8c2bba78b4ed971d2e', // Play Movies Nightly
+  'eca389c5ef975c1c9e07dfd50c59925d64632c3b09c418e7ecfcba3ada13ca6d', // Play Movies Beta
+  'f203e23f6450b65ef0fd9f6ca4006bded3c77151b567352d99c5ca82714a2b85', // Play Movies Stable
+  'cb57437ae9890149f2631062a2be585eb57296d94ae7d603797cdcba026d0939', // Hangouts Extension
+  'e8486d0e4c57480bf87a3ce500627a67cf47dda03b85872c3b531e17393b2abd', // Hangouts Extension
+  '8ad2bccd6237a721b6a51bce833c38b659188ff98e5f2335c00992e4641b23ee', // Hangouts Extension
+  '686d6216be625dab0bb2bec4834181bdee81ff410639eaa55ce42bce2ca38ff8', // Hangouts Extension
+  '0edec707b34d737e6808c1f49c75a41f85abb123eebf92bc16a4d933fb91c0cb', // Hangouts Extension
+  '8e37e180c80468f45822ecaa66e22f831bcc84f2b169fe815d42d1b4791ea3e1', // Hangouts Extension
+  'ba5a008415c2a50120975b653517565579ecfba2682079eed8b7f5b10d9c79e2', // Hangouts Extension
+  'e902e84eabdc1f3bd51bc2d86326a42575e0e59f0840339a300cf281fb28ad49', // Hangouts Extension
+  'f511aceaf81313f414f84dc0222f280fc3c323b7350e8a233d4bd78c36fdddad', // GLS nightly
+  'a5655706f72a6d3e7a0031b6828ce1f24afebd7144f0d591ccc47b32961a2356', // GLS stable
 ];
 
+
 /**
  * Function to determine whether or not a given extension id is whitelisted to
- * invoke the feedback UI.
+ * invoke the feedback UI. If the extension is whitelisted, the callback to
+ * start the Feedback UI will be called.
  * @param {string} id the id of the sender extension.
- * @return {boolean} Whether or not this sender is whitelisted.
+ * @param {Function} startFeedbackCallback The callback function that will
+ *     will start the feedback UI.
+ * @param {Object} feedbackInfo The feedback info object to pass to the
+ *     start feedback UI callback.
  */
-function senderWhitelisted(id) {
-  return id && whitelistedExtensionIds.indexOf(id) != -1;
+function senderWhitelisted(id, startFeedbackCallback, feedbackInfo) {
+  crypto.subtle.digest('SHA-256', (new TextEncoder).encode(id)).then(

[arv (Not doing code reviews), 2015/02/20 23:28:20]

new TextEncoder().encode(id)

[rkc, 2015/02/23 20:03:30]

Throws an exception when I remove the parenthesis.
"Error in event handler for runtime.onMessageExternal: TypeError: undefined is
not a function
    at senderWhitelisted
(chrome-extension://gfdkimpbcpahaombhbimeihdjnejgicl/js/event_handler.js:69:32)"

+      function(hashBuffer) {
+    var hashString = '';
+    var hashView = new Uint8Array(hashBuffer);
+    for (var i = 0; i < hashView.length; ++i) {
+      var hex = hashView[i].toString(16);
+      hex = '0'.substr(0, 2 - hex.length) + hex;

[arv (Not doing code reviews), 2015/02/20 23:28:20]

No need to muck with substr here.

var n = hashView[i];
hashString += n < 0x10 ? '0' : n.toString(16);

[rkc, 2015/02/23 20:03:30]

Done (with the fixed version).

+      hashString += hex;
+    }
+    if (whitelistedExtensionIds.indexOf(hashString) != -1)
+      startFeedbackCallback(feedbackInfo);
+  });
 }
 
 /**
@@ -82,8 +101,8 @@ function feedbackReadyHandler(request, sender, sendResponse) {
  * @param {function(Object)} sendResponse Callback for sending a response.
  */
 function requestFeedbackHandler(request, sender, sendResponse) {
-  if (request.requestFeedback && senderWhitelisted(sender.id))
-    startFeedbackUI(request.feedbackInfo);
+  if (request.requestFeedback)
+    senderWhitelisted(sender.id, startFeedbackUI, request.feedbackInfo);
 }
 
 /**