Add command line flag to override gallery update urls

This will be helpful for testing installs via the web store pointing at a test
server, and potentially for testing autoupdate as well.

Also remove the kGalleryBrowsePrefix constant while I was in the neighborhood, 
since it turns out it's not used anywhere in our code anymore.

BUG=63511
TEST=Run chrome with --app-gallery-update-url=<SOMEURL>. Go to the web store
and try installing an app - the request to download the .crx file should go
<SOMEURL> with some extra parameters tacked on including the extension id,
etc. instead of http://clients2.google.com/service/update2/crx.



Review URL: http://codereview.chromium.org/5119003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@67625 0039d316-1c4b-4281-b951-d872f2087c98

13 files changed, 43 insertions, 48 deletions

diff --git a/chrome/browser/extensions/extension_gallery_install_apitest.cc b/chrome/browser/extensions/extension_gallery_install_apitest.cc
index 820d9ef..423c0a7 100644
--- a/chrome/browser/extensions/extension_gallery_install_apitest.cc
+++ b/chrome/browser/extensions/extension_gallery_install_apitest.cc
@@ -24,8 +24,9 @@ class ExtensionGalleryInstallApiTest : public ExtensionApiTest {
 
     std::string testing_install_base_url = base_url;
     testing_install_base_url += "good.crx";
-    CompleteInstallFunction::SetTestingInstallBaseUrl(
-        testing_install_base_url.c_str());
+
+    CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+      switches::kAppsGalleryUpdateURL, testing_install_base_url);
 
     std::string page_url = base_url;
     page_url += "api_test/extension_gallery_install/" + page;
diff --git a/chrome/browser/extensions/extension_updater.cc b/chrome/browser/extensions/extension_updater.cc
index 573da94..15e26aa 100644
--- a/chrome/browser/extensions/extension_updater.cc
+++ b/chrome/browser/extensions/extension_updater.cc
@@ -47,12 +47,6 @@ using prefs::kExtensionBlacklistUpdateVersion;
 using prefs::kLastExtensionsUpdateCheck;
 using prefs::kNextExtensionsUpdateCheck;
 
-// NOTE: HTTPS is used here to ensure the response from omaha can be trusted.
-// The response contains a url for fetching the blacklist and a hash value
-// for validation.
-const char* ExtensionUpdater::kBlacklistUpdateUrl =
-    "https://clients2.google.com/service/update2/crx";
-
 // Update AppID for extension blacklist.
 const char* ExtensionUpdater::kBlacklistAppID = "com.google.crx.blacklist";
 
@@ -273,7 +267,7 @@ void ManifestFetchesBuilder::AddExtensionData(
     // Fill in default update URL.
     //
     // TODO(akalin): Figure out if we should use the HTTPS version.
-    update_url = GURL(extension_urls::kGalleryUpdateHttpUrl);
+    update_url = Extension::GalleryUpdateUrl(false);
   } else {
     url_stats_.other_url_count++;
   }
@@ -749,8 +743,11 @@ void ExtensionUpdater::CheckNow() {
 
   // Start a fetch of the blacklist if needed.
   if (blacklist_checks_enabled_ && service_->HasInstalledExtensions()) {
+    // Note: it is very important that we use the https version of the update
+    // url here to avoid DNS hijacking of the blacklist, which is not validated
+    // by a public key signature like .crx files are.
     ManifestFetchData* blacklist_fetch =
-        new ManifestFetchData(GURL(kBlacklistUpdateUrl));
+        new ManifestFetchData(Extension::GalleryUpdateUrl(true));
     std::string version = prefs_->GetString(kExtensionBlacklistUpdateVersion);
     int ping_days =
         CalculatePingDays(service_->extension_prefs()->BlacklistLastPingDay());
diff --git a/chrome/browser/extensions/extension_updater.h b/chrome/browser/extensions/extension_updater.h
index 1e99649..041dba0 100644
--- a/chrome/browser/extensions/extension_updater.h
+++ b/chrome/browser/extensions/extension_updater.h
@@ -189,7 +189,6 @@ class ExtensionUpdater
   static const int kManifestFetcherId = 1;
   static const int kExtensionFetcherId = 2;
 
-  static const char* kBlacklistUpdateUrl;
   static const char* kBlacklistAppID;
 
   // Does common work from constructors.
diff --git a/chrome/browser/extensions/extension_updater_unittest.cc b/chrome/browser/extensions/extension_updater_unittest.cc
index bc1a6ff..b85d5d8 100644
--- a/chrome/browser/extensions/extension_updater_unittest.cc
+++ b/chrome/browser/extensions/extension_updater_unittest.cc
@@ -450,7 +450,7 @@ class ExtensionUpdaterTest : public testing::Test {
               fetch_data.full_url().spec());
   }
 
-  static void TestUpdateUrlDataFromGallery(const char* gallery_url) {
+  static void TestUpdateUrlDataFromGallery(const std::string& gallery_url) {
     MockService service;
     ManifestFetchesBuilder builder(&service);
     ExtensionList extensions;
@@ -924,9 +924,9 @@ TEST(ExtensionUpdaterTest, TestUpdateUrlData) {
   ExtensionUpdaterTest::TestUpdateUrlDataSimple();
   ExtensionUpdaterTest::TestUpdateUrlDataCompound();
   ExtensionUpdaterTest::TestUpdateUrlDataFromGallery(
-      extension_urls::kGalleryUpdateHttpUrl);
+      Extension::GalleryUpdateUrl(false).spec());
   ExtensionUpdaterTest::TestUpdateUrlDataFromGallery(
-      extension_urls::kGalleryUpdateHttpsUrl);
+      Extension::GalleryUpdateUrl(true).spec());
 }
 
 TEST(ExtensionUpdaterTest, TestDetermineUpdates) {
diff --git a/chrome/browser/extensions/extension_webstore_private_api.cc b/chrome/browser/extensions/extension_webstore_private_api.cc
index e1c3dff..468ae14 100644
--- a/chrome/browser/extensions/extension_webstore_private_api.cc
+++ b/chrome/browser/extensions/extension_webstore_private_api.cc
@@ -30,7 +30,6 @@
 
 namespace {
 
-const char* install_base_url = extension_urls::kGalleryUpdateHttpsUrl;
 const char kLoginKey[] = "login";
 const char kTokenKey[] = "token";
 const char kInvalidIdError[] = "Invalid id";
@@ -137,12 +136,6 @@ bool BeginInstallFunction::RunImpl() {
   return true;
 }
 
-// static
-void CompleteInstallFunction::SetTestingInstallBaseUrl(
-    const char* testing_install_base_url) {
-  install_base_url = testing_install_base_url;
-}
-
 bool CompleteInstallFunction::RunImpl() {
   if (!IsWebStoreURL(profile_, source_url()))
     return false;
@@ -164,7 +157,7 @@ bool CompleteInstallFunction::RunImpl() {
   params.push_back("id=" + id);
   params.push_back("lang=" + g_browser_process->GetApplicationLocale());
   params.push_back("uc");
-  std::string url_string = install_base_url;
+  std::string url_string = Extension::GalleryUpdateUrl(true).spec();
 
   GURL url(url_string + "?response=redirect&x=" +
       EscapeQueryParamValue(JoinString(params, '&'), true));
diff --git a/chrome/browser/extensions/extension_webstore_private_api.h b/chrome/browser/extensions/extension_webstore_private_api.h
index 5796ab0..647c8e8 100644
--- a/chrome/browser/extensions/extension_webstore_private_api.h
+++ b/chrome/browser/extensions/extension_webstore_private_api.h
@@ -36,10 +36,6 @@ class BeginInstallFunction : public SyncExtensionFunction {
 };
 
 class CompleteInstallFunction : public SyncExtensionFunction {
- public:
-  // This changes the base of the download url to the crx file to be installed.
-  static void SetTestingInstallBaseUrl(const char* testing_install_base_url);
- protected:
   virtual bool RunImpl();
   DECLARE_EXTENSION_FUNCTION_NAME("webstorePrivate.completeInstall");
 };
diff --git a/chrome/browser/sync/glue/extension_util.cc b/chrome/browser/sync/glue/extension_util.cc
index a0aa08e..a02e8fa 100644
--- a/chrome/browser/sync/glue/extension_util.cc
+++ b/chrome/browser/sync/glue/extension_util.cc
@@ -72,10 +72,8 @@ bool IsExtensionValid(const Extension& extension) {
   // TODO(akalin): Relax this restriction once we've put in UI to
   // approve synced extensions.
   if (!extension.update_url().is_empty() &&
-      (extension.update_url() !=
-       GURL(extension_urls::kGalleryUpdateHttpUrl)) &&
-      (extension.update_url() !=
-       GURL(extension_urls::kGalleryUpdateHttpsUrl))) {
+      (extension.update_url() != Extension::GalleryUpdateUrl(false)) &&
+      (extension.update_url() != Extension::GalleryUpdateUrl(true))) {
     return false;
   }
 
diff --git a/chrome/common/chrome_switches.cc b/chrome/common/chrome_switches.cc
index 1149b86..3e7ffc1 100644
--- a/chrome/common/chrome_switches.cc
+++ b/chrome/common/chrome_switches.cc
@@ -59,6 +59,8 @@ const char kAppsGalleryReturnTokens[]       = "apps-gallery-return-tokens";
 // The URL to use for the gallery link in the app launcher.
 const char kAppsGalleryURL[]                = "apps-gallery-url";
 
+const char kAppsGalleryUpdateURL[]          = "apps-gallery-update-url";
+
 // Disable throbber for extension apps.
 const char kAppsNoThrob[]                   = "apps-no-throb";
 
diff --git a/chrome/common/chrome_switches.h b/chrome/common/chrome_switches.h
index b9bec76..17c1d55 100644
--- a/chrome/common/chrome_switches.h
+++ b/chrome/common/chrome_switches.h
@@ -31,6 +31,7 @@ extern const char kApp[];
 extern const char kAppId[];
 extern const char kAppsGalleryReturnTokens[];
 extern const char kAppsGalleryURL[];
+extern const char kAppsGalleryUpdateURL[];
 extern const char kAppsNoThrob[];
 extern const char kAuthNegotiateDelegateWhitelist[];
 extern const char kAuthSchemes[];
diff --git a/chrome/common/extensions/extension.cc b/chrome/common/extensions/extension.cc
index eaa2533..24ef76c 100644
--- a/chrome/common/extensions/extension.cc
+++ b/chrome/common/extensions/extension.cc
@@ -266,6 +266,22 @@ scoped_refptr<Extension> Extension::Create(const FilePath& path,
   return extension;
 }
 
+namespace {
+const char* kGalleryUpdateHttpUrl =
+    "http://clients2.google.com/service/update2/crx";
+const char* kGalleryUpdateHttpsUrl =
+    "https://clients2.google.com/service/update2/crx";
+}  // namespace
+
+// static
+GURL Extension::GalleryUpdateUrl(bool secure) {
+  CommandLine* cmdline = CommandLine::ForCurrentProcess();
+  if (cmdline->HasSwitch(switches::kAppsGalleryUpdateURL))
+    return GURL(cmdline->GetSwitchValueASCII(switches::kAppsGalleryUpdateURL));
+  else
+    return GURL(secure ? kGalleryUpdateHttpsUrl : kGalleryUpdateHttpUrl);
+}
+
 // static
 int Extension::GetPermissionMessageId(const std::string& permission) {
   return ExtensionConfig::GetSingleton()->GetPermissionMessageId(permission);
@@ -414,7 +430,7 @@ bool Extension::IdIsValid(const std::string& id) {
 std::string Extension::GenerateIdForPath(const FilePath& path) {
   FilePath new_path = Extension::MaybeNormalizePath(path);
   std::string id;
-  if (!GenerateId(WideToUTF8(new_path.ToWStringHack()),&id))
+  if (!GenerateId(WideToUTF8(new_path.ToWStringHack()), &id))
     return "";
   return id;
 }
@@ -2200,8 +2216,8 @@ bool Extension::CanExecuteScriptEverywhere() const {
 }
 
 bool Extension::UpdatesFromGallery() const {
-  return update_url() == GURL(extension_urls::kGalleryUpdateHttpsUrl) ||
-      update_url() == GURL(extension_urls::kGalleryUpdateHttpUrl);
+  return update_url() == GalleryUpdateUrl(false) ||
+         update_url() == GalleryUpdateUrl(true);
 }
 
 ExtensionInfo::ExtensionInfo(const DictionaryValue* manifest,
diff --git a/chrome/common/extensions/extension.h b/chrome/common/extensions/extension.h
index 29bc888..b9ec910 100644
--- a/chrome/common/extensions/extension.h
+++ b/chrome/common/extensions/extension.h
@@ -49,10 +49,10 @@ class Extension : public base::RefCountedThreadSafe<Extension> {
     COMPONENT,          // An integral component of Chrome itself, which
                         // happens to be implemented as an extension. We don't
                         // show these in the management UI.
-    EXTERNAL_PREF_DOWNLOAD, // A crx file from an external directory (via
-                            // prefs), installed from an update URL.
-    EXTERNAL_POLICY_DOWNLOAD, // A crx file from an external directory (via
-                              // admin policies), installed from an update URL.
+    EXTERNAL_PREF_DOWNLOAD,    // A crx file from an external directory (via
+                               // prefs), installed from an update URL.
+    EXTERNAL_POLICY_DOWNLOAD,  // A crx file from an external directory (via
+                               // admin policies), installed from an update URL.
 
     NUM_LOCATIONS
   };
@@ -113,6 +113,9 @@ class Extension : public base::RefCountedThreadSafe<Extension> {
                                          bool require_key,
                                          std::string* error);
 
+  // Return the update url used by gallery/webstore extensions.
+  static GURL GalleryUpdateUrl(bool secure);
+
   // The install message id for |permission|.  Returns 0 if none exists.
   static int GetPermissionMessageId(const std::string& permission);
 
diff --git a/chrome/common/extensions/extension_constants.cc b/chrome/common/extensions/extension_constants.cc
index b37fcba..8efa529 100644
--- a/chrome/common/extensions/extension_constants.cc
+++ b/chrome/common/extensions/extension_constants.cc
@@ -278,12 +278,6 @@ const char* kIllegalPlugins =
 
 namespace extension_urls {
 const char* kGalleryBrowsePrefix = "https://chrome.google.com/extensions";
-const char* kGalleryDownloadPrefix =
-    "https://clients2.googleusercontent.com/crx/download";
-const char* kGalleryUpdateHttpUrl =
-    "http://clients2.google.com/service/update2/crx";
-const char* kGalleryUpdateHttpsUrl =
-    "https://clients2.google.com/service/update2/crx";
 const char* kMiniGalleryBrowsePrefix = "https://tools.google.com/chrome/";
 const char* kMiniGalleryDownloadPrefix = "https://dl-ssl.google.com/chrome/";
 }
diff --git a/chrome/common/extensions/extension_constants.h b/chrome/common/extensions/extension_constants.h
index 8c3bee2..065fd0c 100644
--- a/chrome/common/extensions/extension_constants.h
+++ b/chrome/common/extensions/extension_constants.h
@@ -189,11 +189,6 @@ namespace extension_urls {
   // The greatest common prefixes of the main extensions gallery's browse and
   // download URLs.
   extern const char* kGalleryBrowsePrefix;
-  extern const char* kGalleryDownloadPrefix;
-
-  // The update urls used by gallery/webstore extensions.
-  extern const char* kGalleryUpdateHttpUrl;
-  extern const char* kGalleryUpdateHttpsUrl;
 
   // Same thing for the "minigallery". The minigallery is the temporary static
   // themes gallery that we put up when we launched themes.