Require user opt-in before allowing content script injection on file URLs.

BUG=47180

Review URL: http://codereview.chromium.org/2809034

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@50737 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 18 insertions, 0 deletions

diff --git a/chrome/browser/extensions/extension_startup_browsertest.cc b/chrome/browser/extensions/extension_startup_browsertest.cc
index ed62a40..7566caa 100644
--- a/chrome/browser/extensions/extension_startup_browsertest.cc
+++ b/chrome/browser/extensions/extension_startup_browsertest.cc
@@ -63,6 +63,7 @@ class ExtensionStartupTestBase : public InProcessBrowserTest {
     if (!load_extension_.value().empty()) {
       command_line->AppendSwitchWithValue(switches::kLoadExtension,
                                           load_extension_.ToWStringHack());
+      command_line->AppendSwitch(switches::kDisableExtensionsFileAccessCheck);
     }
   }
 
@@ -143,6 +144,23 @@ IN_PROC_BROWSER_TEST_F(ExtensionsStartupTest, Test) {
   TestInjection(true, true);
 }
 
+// Tests that disallowing file access on an extension prevents it from injecting
+// script into a page with a file URL.
+IN_PROC_BROWSER_TEST_F(ExtensionsStartupTest, NoFileAccess) {
+  WaitForServicesToStart(4, true);  // 1 component extension and 3 others.
+
+  ExtensionsService* service = browser()->profile()->GetExtensionsService();
+  for (size_t i = 0; i < service->extensions()->size(); ++i) {
+    if (service->AllowFileAccess(service->extensions()->at(i))) {
+      service->SetAllowFileAccess(service->extensions()->at(i), false);
+      ui_test_utils::WaitForNotification(
+           NotificationType::USER_SCRIPTS_UPDATED);
+    }
+  }
+
+  TestInjection(false, false);
+}
+
 // ExtensionsLoadTest
 // Ensures that we can startup the browser with --load-extension and see them
 // run.