Disable loading of unpacked extensions when '*' is blacklisted, both via the UI and via the --load-extension switch.

The load-unpacked button is also disabled in this case.

Also did a little IWYU header cleanup that was required after removing pref_service.h from extension_prefs.h.

BUG=104356
TEST=Set the extension blacklist policy to '*'. Loading unpacked extensions and using the --load-extension switch are now disabled.


Review URL: http://codereview.chromium.org/10106021

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@132788 0039d316-1c4b-4281-b951-d872f2087c98

30 files changed, 135 insertions, 88 deletions

diff --git a/chrome/browser/background/background_mode_manager.cc b/chrome/browser/background/background_mode_manager.cc
index a8c49d7..e21c572 100644
--- a/chrome/browser/background/background_mode_manager.cc
+++ b/chrome/browser/background/background_mode_manager.cc
@@ -2,7 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <algorithm>
 #include <string>
+#include <vector>
 
 #include "base/base_paths.h"
 #include "base/bind.h"
@@ -15,6 +17,7 @@
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/browser_shutdown.h"
 #include "chrome/browser/extensions/extension_service.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_info_cache.h"
 #include "chrome/browser/profiles/profile_manager.h"
diff --git a/chrome/browser/chromeos/accessibility/accessibility_util.cc b/chrome/browser/chromeos/accessibility/accessibility_util.cc
index 7ff99f2..480ba53 100644
--- a/chrome/browser/chromeos/accessibility/accessibility_util.cc
+++ b/chrome/browser/chromeos/accessibility/accessibility_util.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/chromeos/accessibility/accessibility_util.h"
 
+#include <queue>
+
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/logging.h"
@@ -12,6 +14,7 @@
 #include "chrome/browser/extensions/component_loader.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/file_reader.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/speech/extension_api/tts_extension_api_platform.h"
diff --git a/chrome/browser/chromeos/login/login_utils.cc b/chrome/browser/chromeos/login/login_utils.cc
index cb009ad..859494a 100644
--- a/chrome/browser/chromeos/login/login_utils.cc
+++ b/chrome/browser/chromeos/login/login_utils.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/chromeos/login/login_utils.h"
 
+#include <algorithm>
 #include <vector>
 
 #include "ash/ash_switches.h"
@@ -47,6 +48,7 @@
 #include "chrome/browser/net/preconnect.h"
 #include "chrome/browser/policy/browser_policy_connector.h"
 #include "chrome/browser/prefs/pref_member.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/signin/signin_manager.h"
diff --git a/chrome/browser/extensions/component_loader.cc b/chrome/browser/extensions/component_loader.cc
index a8723f4..b077315 100644
--- a/chrome/browser/extensions/component_loader.cc
+++ b/chrome/browser/extensions/component_loader.cc
@@ -12,6 +12,7 @@
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/prefs/pref_change_registrar.h"
 #include "chrome/browser/prefs/pref_notifier.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/chrome_paths.h"
diff --git a/chrome/browser/extensions/component_loader.h b/chrome/browser/extensions/component_loader.h
index 4329d05..e6b24b9 100644
--- a/chrome/browser/extensions/component_loader.h
+++ b/chrome/browser/extensions/component_loader.h
@@ -7,9 +7,10 @@
 #pragma once
 
 #include <string>
+#include <vector>
 
-#include "base/gtest_prod_util.h"
 #include "base/file_path.h"
+#include "base/gtest_prod_util.h"
 #include "base/values.h"
 #include "chrome/browser/prefs/pref_change_registrar.h"
 #include "content/public/browser/notification_observer.h"
@@ -124,6 +125,8 @@ class ComponentLoader : public content::NotificationObserver {
   RegisteredComponentExtensions component_extensions_;
 
   PrefChangeRegistrar pref_change_registrar_;
+
+  DISALLOW_COPY_AND_ASSIGN(ComponentLoader);
 };
 
 }  // namespace extensions
diff --git a/chrome/browser/extensions/extension_font_settings_api.cc b/chrome/browser/extensions/extension_font_settings_api.cc
index 87ea3b95..92b7288 100644
--- a/chrome/browser/extensions/extension_font_settings_api.cc
+++ b/chrome/browser/extensions/extension_font_settings_api.cc
@@ -13,6 +13,7 @@
 #include "chrome/browser/extensions/extension_event_router.h"
 #include "chrome/browser/extensions/extension_preference_helpers.h"
 #include "chrome/browser/extensions/extension_service.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/extensions/extension_error_utils.h"
diff --git a/chrome/browser/extensions/extension_preference_api.cc b/chrome/browser/extensions/extension_preference_api.cc
index eb17e36..2d86195 100644
--- a/chrome/browser/extensions/extension_preference_api.cc
+++ b/chrome/browser/extensions/extension_preference_api.cc
@@ -5,8 +5,8 @@
 #include "chrome/browser/extensions/extension_preference_api.h"
 
 #include <map>
+#include <utility>
 
-#include "base/json/json_writer.h"
 #include "base/memory/singleton.h"
 #include "base/stl_util.h"
 #include "base/stringprintf.h"
@@ -18,6 +18,7 @@
 #include "chrome/browser/extensions/extension_prefs.h"
 #include "chrome/browser/extensions/extension_prefs_scope.h"
 #include "chrome/browser/extensions/extension_service.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/extensions/extension_error_utils.h"
diff --git a/chrome/browser/extensions/extension_preference_api.h b/chrome/browser/extensions/extension_preference_api.h
index 847e0f1..7a4c9f9 100644
--- a/chrome/browser/extensions/extension_preference_api.h
+++ b/chrome/browser/extensions/extension_preference_api.h
@@ -12,6 +12,8 @@
 #include "chrome/browser/prefs/pref_change_registrar.h"
 #include "content/public/browser/notification_observer.h"
 
+class PrefService;
+
 namespace base {
 class Value;
 }
diff --git a/chrome/browser/extensions/extension_preference_helpers.cc b/chrome/browser/extensions/extension_preference_helpers.cc
index 64d625b..2c317bb 100644
--- a/chrome/browser/extensions/extension_preference_helpers.cc
+++ b/chrome/browser/extensions/extension_preference_helpers.cc
@@ -9,6 +9,7 @@
 #include "chrome/browser/extensions/extension_event_router.h"
 #include "chrome/browser/extensions/extension_prefs.h"
 #include "chrome/browser/extensions/extension_service.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 
 namespace {
diff --git a/chrome/browser/extensions/extension_preference_helpers.h b/chrome/browser/extensions/extension_preference_helpers.h
index 2d0f5f0..b4d275e 100644
--- a/chrome/browser/extensions/extension_preference_helpers.h
+++ b/chrome/browser/extensions/extension_preference_helpers.h
@@ -15,10 +15,8 @@ class Profile;
 
 namespace base {
 class ListValue;
-class DictionaryValue;
 };
 
-
 namespace extension_preference_helpers {
 
 bool StringToScope(const std::string& s, ExtensionPrefsScope* scope);
@@ -43,6 +41,7 @@ void DispatchEventToExtensions(
     ExtensionAPIPermission::ID permission,
     bool incognito,
     const std::string& browser_pref);
-}
+
+} // namespace extension_preference_helpers
 
 #endif  // CHROME_BROWSER_EXTENSIONS_EXTENSION_PREFERENCE_HELPERS_H_
diff --git a/chrome/browser/extensions/extension_prefs.cc b/chrome/browser/extensions/extension_prefs.cc
index 91c1a6d..7dc67c8 100644
--- a/chrome/browser/extensions/extension_prefs.cc
+++ b/chrome/browser/extensions/extension_prefs.cc
@@ -10,17 +10,15 @@
 #include "chrome/browser/extensions/extension_pref_store.h"
 #include "chrome/browser/extensions/extension_sorting.h"
 #include "chrome/browser/prefs/pref_notifier.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/prefs/scoped_user_pref_update.h"
 #include "chrome/common/chrome_notification_types.h"
-#include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/manifest.h"
 #include "chrome/common/extensions/url_pattern.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "content/public/browser/notification_service.h"
 
-using base::Time;
-
 namespace {
 
 // Additional preferences keys
@@ -620,48 +618,35 @@ void ExtensionPrefs::SetAppNotificationDisabled(
 
 bool ExtensionPrefs::IsExtensionAllowedByPolicy(
     const std::string& extension_id,
-    Extension::Location location) {
-  std::string string_value;
+    Extension::Location location) const {
+  base::StringValue id_value(extension_id);
 
   if (location == Extension::COMPONENT ||
       location == Extension::EXTERNAL_POLICY_DOWNLOAD) {
     return true;
   }
 
-  const ListValue* blacklist =
+  const base::ListValue* blacklist =
       prefs_->GetList(prefs::kExtensionInstallDenyList);
   if (!blacklist || blacklist->empty())
     return true;
 
   // Check the whitelist first.
-  const ListValue* whitelist =
+  const base::ListValue* whitelist =
       prefs_->GetList(prefs::kExtensionInstallAllowList);
-  if (whitelist) {
-    for (ListValue::const_iterator it = whitelist->begin();
-         it != whitelist->end(); ++it) {
-      if (!(*it)->GetAsString(&string_value))
-        LOG(WARNING) << "Failed to read whitelist string.";
-      else if (string_value == extension_id)
-        return true;
-    }
-  }
+  if (whitelist && whitelist->Find(id_value) != whitelist->end())
+    return true;
 
   // Then check the blacklist (the admin blacklist, not the Google blacklist).
-  if (blacklist) {
-    for (ListValue::const_iterator it = blacklist->begin();
-         it != blacklist->end(); ++it) {
-      if (!(*it)->GetAsString(&string_value)) {
-        LOG(WARNING) << "Failed to read blacklist string.";
-      } else {
-        if (string_value == "*")
-          return false;  // Only whitelisted extensions are allowed.
-        if (string_value == extension_id)
-          return false;
-      }
-    }
-  }
+  return blacklist->Find(id_value) == blacklist->end() &&
+         !ExtensionsBlacklistedByDefault();
+}
 
-  return true;
+bool ExtensionPrefs::ExtensionsBlacklistedByDefault() const {
+  const base::ListValue* blacklist =
+      prefs_->GetList(prefs::kExtensionInstallDenyList);
+  base::StringValue wildcard("*");
+  return blacklist && blacklist->Find(wildcard) != blacklist->end();
 }
 
 bool ExtensionPrefs::DidExtensionEscalatePermissions(
@@ -754,7 +739,9 @@ void ExtensionPrefs::UpdateBlacklist(
 namespace {
 
 // Serializes |time| as a string value mapped to |key| in |dictionary|.
-void SaveTime(DictionaryValue* dictionary, const char* key, const Time& time) {
+void SaveTime(DictionaryValue* dictionary,
+              const char* key,
+              const base::Time& time) {
   if (!dictionary)
     return;
   std::string string_value = base::Int64ToString(time.ToInternalValue());
@@ -763,44 +750,44 @@ void SaveTime(DictionaryValue* dictionary, const char* key, const Time& time) {
 
 // The opposite of SaveTime. If |key| is not found, this returns an empty Time
 // (is_null() will return true).
-Time ReadTime(const DictionaryValue* dictionary, const char* key) {
+base::Time ReadTime(const DictionaryValue* dictionary, const char* key) {
   if (!dictionary)
-    return Time();
+    return base::Time();
   std::string string_value;
   int64 value;
   if (dictionary->GetString(key, &string_value)) {
     if (base::StringToInt64(string_value, &value)) {
-      return Time::FromInternalValue(value);
+      return base::Time::FromInternalValue(value);
     }
   }
-  return Time();
+  return base::Time();
 }
 
 }  // namespace
 
-Time ExtensionPrefs::LastPingDay(const std::string& extension_id) const {
+base::Time ExtensionPrefs::LastPingDay(const std::string& extension_id) const {
   DCHECK(Extension::IdIsValid(extension_id));
   return ReadTime(GetExtensionPref(extension_id), kLastPingDay);
 }
 
 void ExtensionPrefs::SetLastPingDay(const std::string& extension_id,
-                                    const Time& time) {
+                                    const base::Time& time) {
   DCHECK(Extension::IdIsValid(extension_id));
   ScopedExtensionPrefUpdate update(prefs_, extension_id);
   SaveTime(update.Get(), kLastPingDay, time);
 }
 
-Time ExtensionPrefs::BlacklistLastPingDay() const {
+base::Time ExtensionPrefs::BlacklistLastPingDay() const {
   return ReadTime(prefs_->GetDictionary(kExtensionsBlacklistUpdate),
                   kLastPingDay);
 }
 
-void ExtensionPrefs::SetBlacklistLastPingDay(const Time& time) {
+void ExtensionPrefs::SetBlacklistLastPingDay(const base::Time& time) {
   DictionaryPrefUpdate update(prefs_, kExtensionsBlacklistUpdate);
   SaveTime(update.Get(), kLastPingDay, time);
 }
 
-Time ExtensionPrefs::LastActivePingDay(const std::string& extension_id) {
+base::Time ExtensionPrefs::LastActivePingDay(const std::string& extension_id) {
   DCHECK(Extension::IdIsValid(extension_id));
   return ReadTime(GetExtensionPref(extension_id), kLastActivePingDay);
 }
diff --git a/chrome/browser/extensions/extension_prefs.h b/chrome/browser/extensions/extension_prefs.h
index d7ead34..ddebe41 100644
--- a/chrome/browser/extensions/extension_prefs.h
+++ b/chrome/browser/extensions/extension_prefs.h
@@ -12,16 +12,16 @@
 
 #include "base/memory/linked_ptr.h"
 #include "base/time.h"
+#include "base/values.h"
 #include "chrome/browser/extensions/extension_content_settings_store.h"
 #include "chrome/browser/extensions/extension_prefs_scope.h"
 #include "chrome/browser/extensions/extension_scoped_prefs.h"
-#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/string_ordinal.h"
-#include "googleurl/src/gurl.h"
 
 class ExtensionPrefValueMap;
 class ExtensionSorting;
+class PrefService;
 class URLPatternSet;
 
 // Class for managing global and per-extension preferences.
@@ -200,7 +200,14 @@ class ExtensionPrefs : public ExtensionContentSettingsStore::Observer,
   // Is the extension with |extension_id| allowed by policy (checking both
   // whitelist and blacklist).
   bool IsExtensionAllowedByPolicy(const std::string& extension_id,
-                                  Extension::Location location);
+                                  Extension::Location location) const;
+
+  // Checks if extensions are blacklisted by default, by policy. When true, this
+  // means that even extensions without an ID should be blacklisted (e.g.
+  // from the command line, or when loaded as an unpacked extension).
+  // IsExtensionAllowedByPolicy() also takes this into account, and should be
+  // used instead when the extension ID is known.
+  bool ExtensionsBlacklistedByDefault() const;
 
   // Returns the last value set via SetLastPingDay. If there isn't such a
   // pref, the returned Time will return true for is_null().
diff --git a/chrome/browser/extensions/extension_sorting.cc b/chrome/browser/extensions/extension_sorting.cc
index da7ba51..f7b770d 100644
--- a/chrome/browser/extensions/extension_sorting.cc
+++ b/chrome/browser/extensions/extension_sorting.cc
@@ -6,6 +6,7 @@
 
 #include "chrome/browser/extensions/extension_scoped_prefs.h"
 #include "chrome/browser/extensions/extension_service.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "content/public/browser/notification_service.h"
 
diff --git a/chrome/browser/extensions/extension_sorting.h b/chrome/browser/extensions/extension_sorting.h
index ea6f557..7ce97e3 100644
--- a/chrome/browser/extensions/extension_sorting.h
+++ b/chrome/browser/extensions/extension_sorting.h
@@ -6,6 +6,7 @@
 #define CHROME_BROWSER_EXTENSIONS_EXTENSION_SORTING_H_
 #pragma once
 
+#include <map>
 #include <string>
 
 #include "base/basictypes.h"
@@ -15,11 +16,12 @@
 
 class ExtensionScopedPrefs;
 class ExtensionServiceInterface;
+class PrefService;
 
 class ExtensionSorting {
  public:
-  explicit ExtensionSorting(ExtensionScopedPrefs* extension_scoped_prefs,
-                            PrefService* pref_service);
+  ExtensionSorting(ExtensionScopedPrefs* extension_scoped_prefs,
+                   PrefService* pref_service);
   ~ExtensionSorting();
 
   // Set up the ExtensionService to inform of changes that require syncing.
diff --git a/chrome/browser/extensions/extension_system.cc b/chrome/browser/extensions/extension_system.cc
index 379ffc6..2026c6c 100644
--- a/chrome/browser/extensions/extension_system.cc
+++ b/chrome/browser/extensions/extension_system.cc
@@ -28,6 +28,7 @@
 #include "chrome/browser/extensions/lazy_background_task_queue.h"
 #include "chrome/browser/extensions/unpacked_installer.h"
 #include "chrome/browser/extensions/user_script_master.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/ui/webui/chrome_url_data_manager.h"
diff --git a/chrome/browser/extensions/extension_system.h b/chrome/browser/extensions/extension_system.h
index e32c048..9b1d14ad 100644
--- a/chrome/browser/extensions/extension_system.h
+++ b/chrome/browser/extensions/extension_system.h
@@ -20,7 +20,6 @@ class ExtensionInfoMap;
 class ExtensionMessageService;
 class ExtensionNavigationObserver;
 class ExtensionPrefs;
-class ExtensionPrefValueMap;
 class ExtensionProcessManager;
 class ExtensionService;
 class Profile;
@@ -191,6 +190,8 @@ class ExtensionSystemImpl : public ExtensionSystem {
   // access to the ResourceContext owned by |io_data_|.
   scoped_ptr<ExtensionProcessManager> extension_process_manager_;
   scoped_ptr<extensions::AlarmManager> alarm_manager_;
+
+  DISALLOW_COPY_AND_ASSIGN(ExtensionSystemImpl);
 };
 
 #endif  // CHROME_BROWSER_EXTENSIONS_EXTENSION_SYSTEM_H_
diff --git a/chrome/browser/extensions/extension_webstore_private_api.cc b/chrome/browser/extensions/extension_webstore_private_api.cc
index f53abff..02a88c47 100644
--- a/chrome/browser/extensions/extension_webstore_private_api.cc
+++ b/chrome/browser/extensions/extension_webstore_private_api.cc
@@ -4,8 +4,6 @@
 
 #include "chrome/browser/extensions/extension_webstore_private_api.h"
 
-#include <string>
-
 #include "base/lazy_instance.h"
 #include "base/memory/scoped_vector.h"
 #include "base/string_util.h"
@@ -18,6 +16,7 @@
 #include "chrome/browser/extensions/extension_prefs.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/webstore_installer.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/signin/token_service.h"
 #include "chrome/browser/signin/token_service_factory.h"
@@ -25,11 +24,11 @@
 #include "chrome/browser/sync/profile_sync_service_factory.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/chrome_switches.h"
-#include "chrome/common/pref_names.h"
 #include "chrome/common/extensions/extension_constants.h"
 #include "chrome/common/extensions/extension_error_utils.h"
 #include "chrome/common/extensions/extension_l10n_util.h"
 #include "chrome/common/net/gaia/gaia_constants.h"
+#include "chrome/common/pref_names.h"
 #include "content/public/browser/gpu_data_manager.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_source.h"
diff --git a/chrome/browser/extensions/unpacked_installer.cc b/chrome/browser/extensions/unpacked_installer.cc
index 34a6dd3..964a69e 100644
--- a/chrome/browser/extensions/unpacked_installer.cc
+++ b/chrome/browser/extensions/unpacked_installer.cc
@@ -19,6 +19,9 @@ using content::BrowserThread;
 
 namespace {
 
+const char kUnpackedExtensionsBlacklistedError[] =
+    "Loading of unpacked extensions is disabled by the administrator.";
+
 // Manages an ExtensionInstallUI for a particular extension.
 class SimpleExtensionLoadPrompt : public ExtensionInstallUI::Delegate {
  public:
@@ -107,6 +110,11 @@ void UnpackedInstaller::LoadFromCommandLine(const FilePath& path_in) {
   extension_path_ = path_in;
   file_util::AbsolutePath(&extension_path_);
 
+  if (!IsLoadingUnpackedAllowed()) {
+    ReportExtensionLoadError(kUnpackedExtensionsBlacklistedError);
+    return;
+  }
+
   std::string id = Extension::GenerateIdForPath(extension_path_);
   bool allow_file_access =
       Extension::ShouldAlwaysAllowFileAccess(Extension::LOAD);
@@ -127,13 +135,21 @@ void UnpackedInstaller::LoadFromCommandLine(const FilePath& path_in) {
       &error));
 
   if (!extension) {
-    service_weak_->ReportExtensionLoadError(extension_path_, error, true);
+    ReportExtensionLoadError(error);
     return;
   }
 
   OnLoaded(extension);
 }
 
+bool UnpackedInstaller::IsLoadingUnpackedAllowed() const {
+  if (!service_weak_)
+    return true;
+  // If there is a "*" in the extension blacklist, then no extensions should be
+  // allowed at all (except explicitly whitelisted extensions).
+  return !service_weak_->extension_prefs()->ExtensionsBlacklistedByDefault();
+}
+
 void UnpackedInstaller::GetAbsolutePath() {
   CHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
 
@@ -145,6 +161,14 @@ void UnpackedInstaller::GetAbsolutePath() {
 
 void UnpackedInstaller::CheckExtensionFileAccess() {
   CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
+  if (!service_weak_)
+    return;
+
+  if (!IsLoadingUnpackedAllowed()) {
+    ReportExtensionLoadError(kUnpackedExtensionsBlacklistedError);
+    return;
+  }
+
   std::string id = Extension::GenerateIdForPath(extension_path_);
   // Unpacked extensions default to allowing file access, but if that has been
   // overridden, don't reset the value.
diff --git a/chrome/browser/extensions/unpacked_installer.h b/chrome/browser/extensions/unpacked_installer.h
index f73d57a..437e223 100644
--- a/chrome/browser/extensions/unpacked_installer.h
+++ b/chrome/browser/extensions/unpacked_installer.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -47,6 +47,9 @@ class UnpackedInstaller
   explicit UnpackedInstaller(ExtensionService* extension_service);
   virtual ~UnpackedInstaller();
 
+  // Verifies if loading unpacked extensions is allowed.
+  bool IsLoadingUnpackedAllowed() const;
+
   // We change the input extension path to an absolute path, on the file thread.
   // Then we need to check the file access preference, which needs
   // to happen back on the UI thread, so it posts CheckExtensionFileAccess on
diff --git a/chrome/browser/first_run/first_run_win.cc b/chrome/browser/first_run/first_run_win.cc
index 257d5d0..23322a2 100644
--- a/chrome/browser/first_run/first_run_win.cc
+++ b/chrome/browser/first_run/first_run_win.cc
@@ -7,9 +7,6 @@
 #include <shlobj.h>
 #include <windows.h>
 
-#include <set>
-#include <sstream>
-
 #include "base/environment.h"
 #include "base/file_util.h"
 #include "base/path_service.h"
@@ -28,6 +25,7 @@
 #include "chrome/browser/importer/importer_host.h"
 #include "chrome/browser/importer/importer_list.h"
 #include "chrome/browser/importer/importer_progress_dialog.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/process_singleton.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_notification_types.h"
@@ -53,8 +51,6 @@
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/base/ui_base_switches.h"
 
-using content::UserMetricsAction;
-
 namespace {
 
 // Helper class that performs delayed first-run tasks that need more of the
@@ -77,14 +73,13 @@ class FirstRunDelayedTasks : public content::NotificationObserver {
 
   virtual void Observe(int type,
                        const content::NotificationSource& source,
-                       const content::NotificationDetails& details) {
+                       const content::NotificationDetails& details) OVERRIDE {
     // After processing the notification we always delete ourselves.
     if (type == chrome::NOTIFICATION_EXTENSIONS_READY) {
       DoExtensionWork(
           content::Source<Profile>(source).ptr()->GetExtensionService());
     }
     delete this;
-    return;
   }
 
  private:
@@ -95,10 +90,8 @@ class FirstRunDelayedTasks : public content::NotificationObserver {
   // If the extension specified in the master pref is older than the live
   // extension it will get updated which is the same as get it installed.
   void DoExtensionWork(ExtensionService* service) {
-    if (!service)
-      return;
-    service->updater()->CheckNow();
-    return;
+    if (service)
+      service->updater()->CheckNow();
   }
 
   content::NotificationRegistrar registrar_;
@@ -250,10 +243,6 @@ void SetRLZPref(first_run::MasterPrefs* out_prefs,
   }
 }
 
-}  // namespace
-
-namespace {
-
 // This class is used by first_run::ImportSettings to determine when the import
 // process has ended and what was the result of the operation as reported by
 // the process exit code. This class executes in the context of the main chrome
@@ -277,7 +266,7 @@ class ImportProcessRunner : public base::win::ObjectWatcher::Delegate {
   int exit_code() const { return exit_code_; }
 
   // The child process has terminated. Find the exit code and quit the loop.
-  virtual void OnObjectSignaled(HANDLE object) {
+  virtual void OnObjectSignaled(HANDLE object) OVERRIDE {
     DCHECK(object == import_process_);
     if (!::GetExitCodeProcess(import_process_, &exit_code_)) {
       NOTREACHED();
@@ -317,7 +306,7 @@ class HungImporterMonitor : public WorkerThreadTicker::Callback {
   }
 
  private:
-  virtual void OnTick() {
+  virtual void OnTick() OVERRIDE {
     if (!import_process_)
       return;
     // We find the top active popup that we own, this will be either the
@@ -454,7 +443,7 @@ bool ImportSettingsWin(Profile* profile,
 }  // namespace
 
 namespace first_run {
-namespace internal{
+namespace internal {
 
 bool ImportSettings(Profile* profile,
                     scoped_refptr<ImporterHost> importer_host,
diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
index db78104..b6c93a3 100644
--- a/chrome/browser/prefs/browser_prefs.cc
+++ b/chrome/browser/prefs/browser_prefs.cc
@@ -38,6 +38,7 @@
 #include "chrome/browser/policy/cloud_policy_subsystem.h"
 #include "chrome/browser/policy/url_blacklist_manager.h"
 #include "chrome/browser/prefs/incognito_mode_prefs.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/prefs/session_startup_pref.h"
 #include "chrome/browser/printing/print_job_manager.h"
 #include "chrome/browser/profiles/chrome_version_service.h"
diff --git a/chrome/browser/prefs/browser_prefs.h b/chrome/browser/prefs/browser_prefs.h
index bd6c4bc..bbee56d 100644
--- a/chrome/browser/prefs/browser_prefs.h
+++ b/chrome/browser/prefs/browser_prefs.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -22,6 +22,7 @@ void RegisterLocalState(PrefService* local_state);
 void RegisterUserPrefs(PrefService* user_prefs);
 // Migrate prefs from local_state to user_prefs.
 void MigrateBrowserPrefs(PrefService* user_prefs, PrefService* local_state);
+
 } // namespace browser
 
 #endif  // CHROME_BROWSER_PREFS_BROWSER_PREFS_H__
diff --git a/chrome/browser/resources/extensions/extensions.js b/chrome/browser/resources/extensions/extensions.js
index 0bea573..1e7d847 100644
--- a/chrome/browser/resources/extensions/extensions.js
+++ b/chrome/browser/resources/extensions/extensions.js
@@ -181,6 +181,8 @@ cr.define('extensions', function() {
       $('extension-settings').classList.remove('dev-mode');
     }
 
+    $('load-unpacked').disabled = extensionsData.loadUnpackedDisabled;
+
     ExtensionsList.prototype.data_ = extensionsData;
     var extensionList = $('extension-settings-list');
     ExtensionsList.decorate(extensionList);
diff --git a/chrome/browser/themes/theme_service.cc b/chrome/browser/themes/theme_service.cc
index 60e7b99..92cc1e8 100644
--- a/chrome/browser/themes/theme_service.cc
+++ b/chrome/browser/themes/theme_service.cc
@@ -9,6 +9,7 @@
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/extensions/extension_service.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/themes/browser_theme_pack.h"
 #include "chrome/common/chrome_constants.h"
@@ -27,6 +28,7 @@
 
 using content::BrowserThread;
 using content::UserMetricsAction;
+using ui::ResourceBundle;
 
 // Strings used in alignment properties.
 const char* ThemeService::kAlignmentCenter = "center";
diff --git a/chrome/browser/themes/theme_service.h b/chrome/browser/themes/theme_service.h
index 19d454a..dd5f4dc 100644
--- a/chrome/browser/themes/theme_service.h
+++ b/chrome/browser/themes/theme_service.h
@@ -9,6 +9,7 @@
 #include <map>
 #include <set>
 #include <string>
+#include <utility>
 
 #include "base/compiler_specific.h"
 #include "base/memory/ref_counted.h"
@@ -35,7 +36,6 @@ class Image;
 namespace ui {
 class ResourceBundle;
 }
-using ui::ResourceBundle;
 
 #ifdef __OBJC__
 @class NSString;
@@ -302,7 +302,7 @@ class ThemeService : public base::NonThreadSafe,
   mutable NSGradientMap nsgradient_cache_;
 #endif
 
-  ResourceBundle& rb_;
+  ui::ResourceBundle& rb_;
   Profile* profile_;
 
   scoped_refptr<BrowserThemePack> theme_pack_;
diff --git a/chrome/browser/ui/views/browser_actions_container.cc b/chrome/browser/ui/views/browser_actions_container.cc
index 006cc95..fb107a0 100644
--- a/chrome/browser/ui/views/browser_actions_container.cc
+++ b/chrome/browser/ui/views/browser_actions_container.cc
@@ -13,6 +13,7 @@
 #include "chrome/browser/extensions/extension_host.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/extension_tabs_module.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/sessions/restore_tab_helper.h"
 #include "chrome/browser/ui/browser.h"
@@ -45,7 +46,6 @@
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/base/theme_provider.h"
 #include "ui/gfx/canvas.h"
-#include "ui/views/controls/button/menu_button.h"
 #include "ui/views/controls/button/text_button.h"
 #include "ui/views/controls/menu/menu_item_view.h"
 #include "ui/views/controls/menu/menu_model_adapter.h"
diff --git a/chrome/browser/ui/views/browser_actions_container.h b/chrome/browser/ui/views/browser_actions_container.h
index a093bf2..74ad0ed 100644
--- a/chrome/browser/ui/views/browser_actions_container.h
+++ b/chrome/browser/ui/views/browser_actions_container.h
@@ -12,6 +12,7 @@
 
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
+#include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/message_loop_helpers.h"
 #include "chrome/browser/extensions/extension_toolbar_model.h"
@@ -31,7 +32,6 @@
 #include "ui/views/view.h"
 
 class Browser;
-class BrowserActionOverflowMenuController;
 class BrowserActionsContainer;
 class Extension;
 class ExtensionAction;
diff --git a/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc b/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
index f6aa4cf..f6ae7b9 100644
--- a/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
+++ b/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
@@ -10,6 +10,7 @@
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/extension_web_ui.h"
 #include "chrome/browser/history/history_types.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/ui/tab_contents/tab_contents_wrapper.h"
@@ -86,7 +87,6 @@
 #include "chrome/browser/ui/webui/certificate_viewer_ui.h"
 #endif
 
-using content::WebContents;
 using content::WebUI;
 using content::WebUIController;
 
@@ -94,25 +94,25 @@ namespace {
 
 // A function for creating a new WebUI. The caller owns the return value, which
 // may be NULL (for example, if the URL refers to an non-existent extension).
-typedef WebUIController* (*WebUIFactoryFunction)(content::WebUI* web_ui,
+typedef WebUIController* (*WebUIFactoryFunction)(WebUI* web_ui,
                                                  const GURL& url);
 
 // Template for defining WebUIFactoryFunction.
 template<class T>
-WebUIController* NewWebUI(content::WebUI* web_ui, const GURL& url) {
+WebUIController* NewWebUI(WebUI* web_ui, const GURL& url) {
   return new T(web_ui);
 }
 
 // Special case for extensions.
 template<>
-WebUIController* NewWebUI<ExtensionWebUI>(content::WebUI* web_ui,
+WebUIController* NewWebUI<ExtensionWebUI>(WebUI* web_ui,
                                           const GURL& url) {
   return new ExtensionWebUI(web_ui, url);
 }
 
 // Special case for older about: handlers.
 template<>
-WebUIController* NewWebUI<AboutUI>(content::WebUI* web_ui, const GURL& url) {
+WebUIController* NewWebUI<AboutUI>(WebUI* web_ui, const GURL& url) {
   return new AboutUI(web_ui, url.host());
 }
 
@@ -121,7 +121,7 @@ WebUIController* NewWebUI<AboutUI>(content::WebUI* web_ui, const GURL& url) {
 // to another container type, like an extension background page. If there is
 // no WebUI (it's not accessible when calling GetWebUIType and related
 // functions) then we conservatively assume that we need a WebUI.
-bool NeedsExtensionWebUI(content::WebUI* web_ui,
+bool NeedsExtensionWebUI(WebUI* web_ui,
                          Profile* profile,
                          const GURL& url) {
   ExtensionService* service = profile ? profile->GetExtensionService() : NULL;
@@ -134,7 +134,7 @@ bool NeedsExtensionWebUI(content::WebUI* web_ui,
 // Returns a function that can be used to create the right type of WebUI for a
 // tab, based on its URL. Returns NULL if the URL doesn't have WebUI associated
 // with it.
-WebUIFactoryFunction GetWebUIFactoryFunction(content::WebUI* web_ui,
+WebUIFactoryFunction GetWebUIFactoryFunction(WebUI* web_ui,
                                              Profile* profile,
                                              const GURL& url) {
   if (NeedsExtensionWebUI(web_ui, profile, url))
@@ -414,7 +414,7 @@ bool ChromeWebUIControllerFactory::IsURLAcceptableForWebUI(
 }
 
 WebUIController* ChromeWebUIControllerFactory::CreateWebUIControllerForURL(
-    content::WebUI* web_ui,
+    WebUI* web_ui,
     const GURL& url) const {
   Profile* profile = Profile::FromWebUI(web_ui);
   WebUIFactoryFunction function = GetWebUIFactoryFunction(web_ui, profile, url);
diff --git a/chrome/browser/ui/webui/extensions/extension_settings_handler.cc b/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
index 3a107dd..d26783c 100644
--- a/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
+++ b/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
@@ -25,6 +25,7 @@
 #include "chrome/browser/extensions/unpacked_installer.h"
 #include "chrome/browser/extensions/updater/extension_updater.h"
 #include "chrome/browser/google/google_util.h"
+#include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/tab_contents/background_contents.h"
 #include "chrome/browser/ui/webui/extensions/extension_icon_source.h"
@@ -385,6 +386,7 @@ void ExtensionSettingsHandler::Observe(
     case chrome::NOTIFICATION_EXTENSION_UPDATE_DISABLED:
     case chrome::NOTIFICATION_EXTENSION_WARNING_CHANGED:
     case chrome::NOTIFICATION_EXTENSION_BROWSER_ACTION_VISIBILITY_CHANGED:
+    case chrome::NOTIFICATION_PREF_CHANGED:
       MaybeUpdateAfterNotification();
       break;
     default:
@@ -486,6 +488,10 @@ void ExtensionSettingsHandler::HandleRequestExtensionsData(
       profile->GetPrefs()->GetBoolean(prefs::kExtensionsUIDeveloperMode);
   results.SetBoolean("developerMode", developer_mode);
 
+  bool load_unpacked_disabled =
+      extension_service_->extension_prefs()->ExtensionsBlacklistedByDefault();
+  results.SetBoolean("loadUnpackedDisabled", load_unpacked_disabled);
+
   web_ui()->CallJavascriptFunction("ExtensionSettings.returnExtensionsData",
                                    results);
   content::WebContentsObserver::Observe(web_ui()->GetWebContents());
@@ -747,6 +753,9 @@ void ExtensionSettingsHandler::MaybeRegisterForNotifications() {
       chrome::NOTIFICATION_EXTENSION_BROWSER_ACTION_VISIBILITY_CHANGED,
       content::Source<ExtensionPrefs>(profile->GetExtensionService()->
                              extension_prefs()));
+
+  pref_registrar_.Init(profile->GetPrefs());
+  pref_registrar_.Add(prefs::kExtensionInstallDenyList, this);
 }
 
 std::vector<ExtensionPage>
diff --git a/chrome/browser/ui/webui/extensions/extension_settings_handler.h b/chrome/browser/ui/webui/extensions/extension_settings_handler.h
index fbdbd66..0996384 100644
--- a/chrome/browser/ui/webui/extensions/extension_settings_handler.h
+++ b/chrome/browser/ui/webui/extensions/extension_settings_handler.h
@@ -14,6 +14,7 @@
 #include "chrome/browser/extensions/extension_install_ui.h"
 #include "chrome/browser/extensions/extension_uninstall_dialog.h"
 #include "chrome/browser/extensions/extension_warning_set.h"
+#include "chrome/browser/prefs/pref_change_registrar.h"
 #include "chrome/browser/ui/select_file_dialog.h"
 #include "chrome/common/extensions/extension_resource.h"
 #include "content/public/browser/navigation_controller.h"
@@ -29,7 +30,6 @@ class ExtensionHost;
 class ExtensionService;
 class FilePath;
 class PrefService;
-class UserScript;
 
 namespace base {
 class DictionaryValue;
@@ -202,6 +202,8 @@ class ExtensionSettingsHandler : public content::WebUIMessageHandler,
 
   content::NotificationRegistrar registrar_;
 
+  PrefChangeRegistrar pref_registrar_;
+
   DISALLOW_COPY_AND_ASSIGN(ExtensionSettingsHandler);
 };