Allow silent extension installations from the extensions gallery - Part 1.

In this episode we:
-Create a new ChildProcess privilege (SILENT_INSTALL_EXTENSION) which is granted to the extension gallery pages.
-Ensure that extension gallery pages are isolated into their own process which is never shared with other urls.

Important: The SILENT_INSTALL_EXTENSION privilege is never granted any additional abilities in this patch, so this patch only has the effect of grouping gallery URLs into a separate process.

In subsequent patch(es) we plan to (a) observe this new privilege and allow gallery urls to install extensions bypassing the normal prompts, (b) polish this UI flow [in particular, do not show the black "loading" dilaog, (c) check the id of the extension to be installed (from the crx) matches the expected id (from gallery url).

BUG=27431

Review URL: http://codereview.chromium.org/400018

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@33952 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 101 insertions, 9 deletions

diff --git a/chrome/browser/tab_contents/web_contents_unittest.cc b/chrome/browser/tab_contents/web_contents_unittest.cc
index 9b59406..e4cb6533 100644
--- a/chrome/browser/tab_contents/web_contents_unittest.cc
+++ b/chrome/browser/tab_contents/web_contents_unittest.cc
@@ -13,6 +13,10 @@
 #include "chrome/browser/tab_contents/navigation_entry.h"
 #include "chrome/browser/tab_contents/test_tab_contents.h"
 #include "chrome/common/chrome_paths.h"
+#include "chrome/common/extensions/extension.h"
+#include "chrome/common/extensions/extension_constants.h"
+#include "chrome/common/notification_service.h"
+#include "chrome/common/notification_type.h"
 #include "chrome/common/pref_service.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/url_constants.h"
@@ -208,6 +212,38 @@ class TabContentsTest : public RenderViewHostTestHarness {
   ChromeThread ui_thread_;
 };
 
+// Used to block until a navigation completes.
+class RenderViewHostDeletedObserver : public NotificationObserver {
+ public:
+  RenderViewHostDeletedObserver(TabContents* contents,
+                                RenderViewHost* render_view_host)
+      : render_view_host_(render_view_host),
+        deleted_(false) {
+    registrar_.Add(this, NotificationType::RENDER_VIEW_HOST_DELETED,
+                   Source<TabContents>(contents));
+  }
+
+  virtual void Observe(NotificationType type,
+                       const NotificationSource& source,
+                       const NotificationDetails& details) {
+    if (type == NotificationType::RENDER_VIEW_HOST_DELETED &&
+        render_view_host_ == Details<RenderViewHost>(details).ptr()) {
+      deleted_ = true;
+    }
+  }
+
+  bool deleted() { return deleted_; }
+
+ private:
+  NotificationRegistrar registrar_;
+
+  RenderViewHost* render_view_host_;
+
+  bool deleted_;
+
+  DISALLOW_COPY_AND_ASSIGN(RenderViewHostDeletedObserver);
+};
+
 // Test to make sure that title updates get stripped of whitespace.
 TEST_F(TabContentsTest, UpdateTitle) {
   ViewHostMsg_FrameNavigate_Params params;
@@ -277,8 +313,7 @@ TEST_F(TabContentsTest, SimpleNavigation) {
 TEST_F(TabContentsTest, CrossSiteBoundaries) {
   contents()->transition_cross_site = true;
   TestRenderViewHost* orig_rvh = rvh();
-  int orig_rvh_delete_count = 0;
-  orig_rvh->set_delete_counter(&orig_rvh_delete_count);
+  RenderViewHostDeletedObserver orig_rvh_deleted_observer(contents(), orig_rvh);
   SiteInstance* instance1 = contents()->GetSiteInstance();
 
   // Navigate to URL.  First URL should use first RenderViewHost.
@@ -296,8 +331,8 @@ TEST_F(TabContentsTest, CrossSiteBoundaries) {
   controller().LoadURL(url2, GURL(), PageTransition::TYPED);
   EXPECT_TRUE(contents()->cross_navigation_pending());
   TestRenderViewHost* pending_rvh = contents()->pending_rvh();
-  int pending_rvh_delete_count = 0;
-  pending_rvh->set_delete_counter(&pending_rvh_delete_count);
+  RenderViewHostDeletedObserver pending_rvh_deleted_observer(contents(),
+                                                             pending_rvh);
 
   // DidNavigate from the pending page
   ViewHostMsg_FrameNavigate_Params params2;
@@ -309,7 +344,7 @@ TEST_F(TabContentsTest, CrossSiteBoundaries) {
   EXPECT_EQ(pending_rvh, contents()->render_view_host());
   EXPECT_NE(instance1, instance2);
   EXPECT_TRUE(contents()->pending_rvh() == NULL);
-  EXPECT_EQ(orig_rvh_delete_count, 1);
+  EXPECT_TRUE(orig_rvh_deleted_observer.deleted());
 
   // Going back should switch SiteInstances again.  The first SiteInstance is
   // stored in the NavigationEntry, so it should be the same as at the start.
@@ -321,17 +356,74 @@ TEST_F(TabContentsTest, CrossSiteBoundaries) {
   contents()->TestDidNavigate(goback_rvh, params1);
   EXPECT_FALSE(contents()->cross_navigation_pending());
   EXPECT_EQ(goback_rvh, contents()->render_view_host());
-  EXPECT_EQ(pending_rvh_delete_count, 1);
+  EXPECT_TRUE(pending_rvh_deleted_observer.deleted());
   EXPECT_EQ(instance1, contents()->GetSiteInstance());
 }
 
+// Test that extension gallery URLs are isolated into their own SiteInstance
+// (distinct, in particular, from other other *.google.com domains).
+TEST_F(TabContentsTest, IsolateGalleryURLs) {
+  contents()->transition_cross_site = true;
+  TestRenderViewHost* orig_rvh = rvh();
+  RenderViewHostDeletedObserver orig_rvh_deleted_observer(contents(), orig_rvh);
+  SiteInstance* instance1 = contents()->GetSiteInstance();
+
+  // Navigate to first non-gallery URL.
+  const GURL url("https://calendar.google.com");
+  controller().LoadURL(url, GURL(), PageTransition::TYPED);
+  ViewHostMsg_FrameNavigate_Params params1;
+  InitNavigateParams(&params1, 1, url);
+  contents()->TestDidNavigate(orig_rvh, params1);
+
+  EXPECT_FALSE(contents()->cross_navigation_pending());
+  EXPECT_EQ(orig_rvh, contents()->render_view_host());
+
+  // Navigate to gallery browser url.
+  const GURL url2(extension_urls::kGalleryBrowsePrefix);
+  controller().LoadURL(url2, GURL(), PageTransition::TYPED);
+  EXPECT_TRUE(contents()->cross_navigation_pending());
+  TestRenderViewHost* pending_rvh = contents()->pending_rvh();
+  RenderViewHostDeletedObserver pending_rvh_deleted_observer(contents(),
+                                                             pending_rvh);
+
+  ViewHostMsg_FrameNavigate_Params params2;
+  InitNavigateParams(&params2, 1, url2);
+  contents()->TestDidNavigate(pending_rvh, params2);
+  SiteInstance* instance2 = contents()->GetSiteInstance();
+
+  EXPECT_FALSE(contents()->cross_navigation_pending());
+  EXPECT_EQ(pending_rvh, contents()->render_view_host());
+  EXPECT_NE(instance1, instance2);
+  EXPECT_TRUE(contents()->pending_rvh() == NULL);
+  EXPECT_TRUE(orig_rvh_deleted_observer.deleted());
+
+  // Navigate again to another non-gallery google url
+  const GURL url3("https://mail.google.com");
+  controller().LoadURL(url3, GURL(), PageTransition::TYPED);
+  EXPECT_TRUE(contents()->cross_navigation_pending());
+  TestRenderViewHost* pending_rvh2 = contents()->pending_rvh();
+
+  ViewHostMsg_FrameNavigate_Params params3;
+  InitNavigateParams(&params3, 1, url3);
+  contents()->TestDidNavigate(pending_rvh2, params3);
+  SiteInstance* instance3 = contents()->GetSiteInstance();
+
+  EXPECT_FALSE(contents()->cross_navigation_pending());
+  EXPECT_EQ(pending_rvh2, contents()->render_view_host());
+  EXPECT_NE(instance2, instance3);
+  // TODO(creis): This should actually be EXPECT_EQ. see crbug.com/29146.
+  // e.g. This first and third instances *should* be the same.
+  EXPECT_NE(instance1, instance3);
+  EXPECT_TRUE(contents()->pending_rvh() == NULL);
+  EXPECT_TRUE(pending_rvh_deleted_observer.deleted());
+}
+
 // Test that navigating across a site boundary after a crash creates a new
 // RVH without requiring a cross-site transition (i.e., PENDING state).
 TEST_F(TabContentsTest, CrossSiteBoundariesAfterCrash) {
   contents()->transition_cross_site = true;
   TestRenderViewHost* orig_rvh = rvh();
-  int orig_rvh_delete_count = 0;
-  orig_rvh->set_delete_counter(&orig_rvh_delete_count);
+  RenderViewHostDeletedObserver orig_rvh_deleted_observer(contents(), orig_rvh);
   SiteInstance* instance1 = contents()->GetSiteInstance();
 
   // Navigate to URL.  First URL should use first RenderViewHost.
@@ -354,7 +446,7 @@ TEST_F(TabContentsTest, CrossSiteBoundariesAfterCrash) {
   EXPECT_FALSE(contents()->cross_navigation_pending());
   EXPECT_TRUE(contents()->pending_rvh() == NULL);
   EXPECT_NE(orig_rvh, new_rvh);
-  EXPECT_EQ(orig_rvh_delete_count, 1);
+  EXPECT_TRUE(orig_rvh_deleted_observer.deleted());
 
   // DidNavigate from the new page
   ViewHostMsg_FrameNavigate_Params params2;