summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--chrome/browser/browser.cc11
-rw-r--r--chrome/browser/dom_ui/ntp_resource_cache.cc2
-rw-r--r--chrome/browser/download/download_manager.cc11
-rw-r--r--chrome/browser/download/download_util.cc19
-rw-r--r--chrome/browser/download/download_util.h3
-rw-r--r--chrome/browser/extensions/extension_webstore_private_api.cc23
-rw-r--r--chrome/browser/extensions/extensions_service.cc112
-rw-r--r--chrome/browser/extensions/extensions_service.h12
-rw-r--r--chrome/browser/extensions/extensions_ui.cc14
-rw-r--r--chrome/common/extensions/extension.cc11
-rw-r--r--chrome/common/extensions/extension.h8
11 files changed, 110 insertions, 116 deletions
diff --git a/chrome/browser/browser.cc b/chrome/browser/browser.cc
index 29eebb61..00c16e3 100644
--- a/chrome/browser/browser.cc
+++ b/chrome/browser/browser.cc
@@ -3002,10 +3002,13 @@ void Browser::OnStartDownload(DownloadItem* download, TabContents* tab) {
#if defined(OS_CHROMEOS)
// Don't show content browser for extension/theme downloads from gallery.
- if (download->is_extension_install() &&
- ExtensionsService::IsDownloadFromGallery(download->url(),
- download->referrer_url()))
- return;
+ if (download->is_extension_install()) {
+ ExtensionsService* service = profile_->GetExtensionsService();
+ if (service && service->IsDownloadFromGallery(download->url(),
+ download->referrer_url())) {
+ return;
+ }
+ }
// skip the download shelf and just open the file browser in chromeos
std::string arg = download->full_path().DirName().value();
diff --git a/chrome/browser/dom_ui/ntp_resource_cache.cc b/chrome/browser/dom_ui/ntp_resource_cache.cc
index 2e61765..903f935 100644
--- a/chrome/browser/dom_ui/ntp_resource_cache.cc
+++ b/chrome/browser/dom_ui/ntp_resource_cache.cc
@@ -294,7 +294,7 @@ void NTPResourceCache::CreateNewTabHTML() {
localized_strings.SetString("web_store_title",
l10n_util::GetStringUTF16(IDS_EXTENSION_WEB_STORE_TITLE));
localized_strings.SetString("web_store_url",
- GetUrlWithLang(GURL(Extension::ChromeStoreURL())));
+ GetUrlWithLang(GURL(Extension::ChromeStoreLaunchURL())));
localized_strings.SetString("appspromohide",
l10n_util::GetStringUTF16(IDS_APPS_PROMO_HIDE));
localized_strings.SetString("appspromoheader",
diff --git a/chrome/browser/download/download_manager.cc b/chrome/browser/download/download_manager.cc
index bb9aeea..af3049e 100644
--- a/chrome/browser/download/download_manager.cc
+++ b/chrome/browser/download/download_manager.cc
@@ -295,16 +295,7 @@ void DownloadManager::StartDownload(DownloadCreateInfo* info) {
if (!info->prompt_user_for_save_location &&
info->save_info.file_path.empty()) {
- // Downloads can be marked as dangerous for two reasons:
- // a) They have a dangerous-looking filename
- // b) They are an extension that is not from the gallery
- if (download_util::IsExecutableFile(info->suggested_path.BaseName()))
- info->is_dangerous = true;
- else if (info->is_extension_install &&
- !ExtensionsService::IsDownloadFromGallery(info->url,
- info->referrer_url)) {
- info->is_dangerous = true;
- }
+ info->is_dangerous = download_util::IsDangerous(info, profile());
}
// We need to move over to the download thread because we don't want to stat
diff --git a/chrome/browser/download/download_util.cc b/chrome/browser/download/download_util.cc
index 0a54b01..9b121b5 100644
--- a/chrome/browser/download/download_util.cc
+++ b/chrome/browser/download/download_util.cc
@@ -252,7 +252,7 @@ void OpenChromeExtension(Profile* profile,
installer->InstallUserScript(download_item.full_path(),
download_item.url());
} else {
- bool is_gallery_download = ExtensionsService::IsDownloadFromGallery(
+ bool is_gallery_download = service->IsDownloadFromGallery(
download_item.url(), download_item.referrer_url());
installer->set_original_mime_type(download_item.original_mime_type());
installer->set_apps_require_extension_mime_type(true);
@@ -731,4 +731,21 @@ FilePath GetCrDownloadPath(const FilePath& suggested_path) {
return FilePath(file_name);
}
+// TODO(erikkay,phajdan.jr): This is apparently not being exercised in tests.
+bool IsDangerous(DownloadCreateInfo* info, Profile* profile) {
+ // Downloads can be marked as dangerous for two reasons:
+ // a) They have a dangerous-looking filename
+ // b) They are an extension that is not from the gallery
+ if (IsExecutableFile(info->suggested_path.BaseName())) {
+ return true;
+ } else if (info->is_extension_install) {
+ ExtensionsService* service = profile->GetExtensionsService();
+ if (!service ||
+ !service->IsDownloadFromGallery(info->url, info->referrer_url)) {
+ return true;
+ }
+ }
+ return false;
+}
+
} // namespace download_util
diff --git a/chrome/browser/download/download_util.h b/chrome/browser/download/download_util.h
index 37e8a82..a32f171 100644
--- a/chrome/browser/download/download_util.h
+++ b/chrome/browser/download/download_util.h
@@ -213,6 +213,9 @@ int GetUniquePathNumberWithCrDownload(const FilePath& path);
// Returns a .crdownload intermediate path for the |suggested_path|.
FilePath GetCrDownloadPath(const FilePath& suggested_path);
+// Whether a given download should be considered potentially dangerous.
+bool IsDangerous(DownloadCreateInfo *info, Profile* profile);
+
} // namespace download_util
#endif // CHROME_BROWSER_DOWNLOAD_DOWNLOAD_UTIL_H_
diff --git a/chrome/browser/extensions/extension_webstore_private_api.cc b/chrome/browser/extensions/extension_webstore_private_api.cc
index 184c9e5..f18c2d5 100644
--- a/chrome/browser/extensions/extension_webstore_private_api.cc
+++ b/chrome/browser/extensions/extension_webstore_private_api.cc
@@ -19,18 +19,13 @@ namespace {
const char* install_base_url = extension_urls::kGalleryUpdateHttpsUrl;
+bool IsWebStoreURL(Profile* profile, const GURL& url) {
+ ExtensionsService* service = profile->GetExtensionsService();
+ Extension* store = service->GetWebStoreApp();
+ DCHECK(store);
+ return (service->GetExtensionByWebExtent(url) == store);
}
-static bool IsWebStoreURL(const GURL& url) {
- GURL store_url(Extension::ChromeStoreURL());
- if (!url.is_valid() || !store_url.is_valid()) {
- return false;
- }
-
- // Ignore port. It may be set on |url| during tests, but cannot be set on
- // ChromeStoreURL.
- return store_url.scheme() == url.scheme() &&
- store_url.host() == url.host();
}
// static
@@ -40,7 +35,7 @@ void InstallFunction::SetTestingInstallBaseUrl(
}
bool InstallFunction::RunImpl() {
- if (!IsWebStoreURL(source_url()))
+ if (!IsWebStoreURL(profile_, source_url()))
return false;
std::string id;
@@ -73,7 +68,7 @@ bool InstallFunction::RunImpl() {
}
bool GetSyncLoginFunction::RunImpl() {
- if (!IsWebStoreURL(source_url()))
+ if (!IsWebStoreURL(profile_, source_url()))
return false;
ProfileSyncService* sync_service = profile_->GetProfileSyncService();
string16 username = sync_service->GetAuthenticatedUsername();
@@ -82,7 +77,7 @@ bool GetSyncLoginFunction::RunImpl() {
}
bool GetStoreLoginFunction::RunImpl() {
- if (!IsWebStoreURL(source_url()))
+ if (!IsWebStoreURL(profile_, source_url()))
return false;
ExtensionsService* service = profile_->GetExtensionsService();
ExtensionPrefs* prefs = service->extension_prefs();
@@ -96,7 +91,7 @@ bool GetStoreLoginFunction::RunImpl() {
}
bool SetStoreLoginFunction::RunImpl() {
- if (!IsWebStoreURL(source_url()))
+ if (!IsWebStoreURL(profile_, source_url()))
return false;
std::string login;
EXTENSION_FUNCTION_VALIDATE(args_->GetString(0, &login));
diff --git a/chrome/browser/extensions/extensions_service.cc b/chrome/browser/extensions/extensions_service.cc
index 457be14..7568cc5 100644
--- a/chrome/browser/extensions/extensions_service.cc
+++ b/chrome/browser/extensions/extensions_service.cc
@@ -150,42 +150,6 @@ PendingExtensionInfo::PendingExtensionInfo()
const char* ExtensionsService::kInstallDirectoryName = "Extensions";
const char* ExtensionsService::kCurrentVersionFileName = "Current Version";
-namespace {
-
-bool IsGalleryDownloadURL(const GURL& download_url) {
- if (StartsWithASCII(download_url.spec(),
- extension_urls::kMiniGalleryDownloadPrefix, false))
- return true;
-
- if (StartsWithASCII(download_url.spec(),
- extension_urls::kGalleryDownloadPrefix, false))
- return true;
-
- // Allow command line gallery url to be referrer for the gallery downloads.
- std::string command_line_gallery_url =
- CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
- switches::kAppsGalleryURL);
- if (!command_line_gallery_url.empty()) {
- if (StartsWithASCII(download_url.spec(), command_line_gallery_url, false))
- return true;
-
- // When using the command-line gallery switch, be a bit more lenient with
- // the check and allow hosts that match the root host.
- std::string download_domain =
- net::RegistryControlledDomainService::GetDomainAndRegistry(
- download_url);
- std::string command_line_domain =
- net::RegistryControlledDomainService::GetDomainAndRegistry(
- GURL(command_line_gallery_url));
- if (download_domain == command_line_domain)
- return true;
- }
-
- return false;
-}
-
-} // namespace
-
// Implements IO for the ExtensionsService.
class ExtensionsServiceBackend
@@ -512,47 +476,53 @@ void ExtensionsServiceBackend::ReloadExtensionManifests(
true));
}
-// static
bool ExtensionsService::IsDownloadFromGallery(const GURL& download_url,
const GURL& referrer_url) {
- if (referrer_url.is_empty() || !referrer_url.is_valid())
- return false;
-
- if (!IsGalleryDownloadURL(download_url))
- return false;
-
- if (StartsWithASCII(referrer_url.spec(),
- extension_urls::kMiniGalleryBrowsePrefix, false))
+ // Special-case the themes mini-gallery.
+ // TODO(erikkay) When that gallery goes away, remove this code.
+ if (IsDownloadFromMiniGallery(download_url) &&
+ StartsWithASCII(referrer_url.spec(),
+ extension_urls::kMiniGalleryBrowsePrefix, false)) {
return true;
+ }
- if (StartsWithASCII(referrer_url.spec(),
- Extension::ChromeStoreURL(), false))
- return true;
+ Extension* download_extension = GetExtensionByWebExtent(download_url);
+ Extension* referrer_extension = GetExtensionByWebExtent(referrer_url);
+ Extension* webstore_app = GetWebStoreApp();
+
+ bool referrer_valid = (referrer_extension == webstore_app);
+ bool download_valid = (download_extension == webstore_app);
+
+ // If the command-line gallery URL is set, then be a bit more lenient.
+ GURL store_url =
+ GURL(CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
+ switches::kAppsGalleryURL));
+ if (!store_url.is_empty()) {
+ std::string store_tld =
+ net::RegistryControlledDomainService::GetDomainAndRegistry(store_url);
+ if (!referrer_valid) {
+ std::string referrer_tld =
+ net::RegistryControlledDomainService::GetDomainAndRegistry(
+ referrer_url);
+ // The referrer gets stripped when transitioning from https to http,
+ // or when hitting an unknown test cert and that commonly happens in
+ // testing environments. Given this, we allow an empty referrer when
+ // the command-line flag is set.
+ // Otherwise, the TLD must match the TLD of the command-line url.
+ referrer_valid = referrer_url.is_empty() || (referrer_tld == store_tld);
+ }
- // Allow command line gallery url to be referrer for the gallery downloads.
- std::string command_line_gallery_url =
- CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
- switches::kAppsGalleryURL);
- if (!command_line_gallery_url.empty()) {
- if (StartsWithASCII(referrer_url.spec(), command_line_gallery_url, false))
- return true;
+ if (!download_valid) {
+ std::string download_tld =
+ net::RegistryControlledDomainService::GetDomainAndRegistry(
+ GURL(download_url));
- // When using the command-line gallery switch, be a bit more lenient with
- // the check and allow hosts that match the root host.
- // TODO(erikkay) On test galleries, the current config sometimes leaves us
- // with an empty referrer. With the command-line flag set, maybe we should
- // just ignore referrer altogether?
- std::string referrer_domain =
- net::RegistryControlledDomainService::GetDomainAndRegistry(
- referrer_url);
- std::string command_line_domain =
- net::RegistryControlledDomainService::GetDomainAndRegistry(
- GURL(command_line_gallery_url));
- if (referrer_domain == command_line_domain)
- return true;
+ // Otherwise, the TLD must match the TLD of the command-line url.
+ download_valid = (download_tld == store_tld);
+ }
}
- return false;
+ return (referrer_valid && download_valid);
}
bool ExtensionsService::IsDownloadFromMiniGallery(const GURL& download_url) {
@@ -1646,6 +1616,10 @@ Extension* ExtensionsService::GetExtensionByIdInternal(const std::string& id,
return NULL;
}
+Extension* ExtensionsService::GetWebStoreApp() {
+ return GetExtensionById(extension_misc::kWebStoreAppId, false);
+}
+
Extension* ExtensionsService::GetExtensionByURL(const GURL& url) {
return url.scheme() != chrome::kExtensionScheme ? NULL :
GetExtensionById(url.host(), false);
diff --git a/chrome/browser/extensions/extensions_service.h b/chrome/browser/extensions/extensions_service.h
index 1cf9fd4..b18c63b 100644
--- a/chrome/browser/extensions/extensions_service.h
+++ b/chrome/browser/extensions/extensions_service.h
@@ -129,11 +129,10 @@ class ExtensionsService
static const char* kCurrentVersionFileName;
// Determine if a given extension download should be treated as if it came
- // from the gallery. Note that this is different from IsGalleryDownloadURL
- // (above) in that in requires *both* that the download_url match and
- // that the download was referred from a gallery page.
- static bool IsDownloadFromGallery(const GURL& download_url,
- const GURL& referrer_url);
+ // from the gallery. Note that this is requires *both* that the download_url
+ // match and that the download was referred from a gallery page.
+ bool IsDownloadFromGallery(const GURL& download_url,
+ const GURL& referrer_url);
// Determine if the downloaded extension came from the theme mini-gallery,
// Used to test if we need to show the "Loading" dialog for themes.
@@ -275,6 +274,9 @@ class ExtensionsService
// Scan the extension directory and clean up the cruft.
void GarbageCollectExtensions();
+ // The App that represents the web store.
+ Extension* GetWebStoreApp();
+
// Lookup an extension by |url|.
Extension* GetExtensionByURL(const GURL& url);
diff --git a/chrome/browser/extensions/extensions_ui.cc b/chrome/browser/extensions/extensions_ui.cc
index 415a922..e379d61 100644
--- a/chrome/browser/extensions/extensions_ui.cc
+++ b/chrome/browser/extensions/extensions_ui.cc
@@ -112,15 +112,17 @@ void ExtensionsUIHTMLSource::StartDataRequest(const std::string& path,
localized_strings.SetString("suggestGallery",
l10n_util::GetStringFUTF16(IDS_EXTENSIONS_NONE_INSTALLED_SUGGEST_GALLERY,
ASCIIToUTF16("<a href='") +
- ASCIIToUTF16(google_util::AppendGoogleLocaleParam(
- GURL(Extension::ChromeStoreURL())).spec()) + ASCIIToUTF16("'>"),
+ ASCIIToUTF16(google_util::AppendGoogleLocaleParam(
+ GURL(Extension::ChromeStoreLaunchURL())).spec()) +
+ ASCIIToUTF16("'>"),
ASCIIToUTF16("</a>")));
localized_strings.SetString("getMoreExtensions",
ASCIIToUTF16("<a href='") +
- ASCIIToUTF16(google_util::AppendGoogleLocaleParam(
- GURL(Extension::ChromeStoreURL())).spec()) + ASCIIToUTF16("'>") +
- l10n_util::GetStringUTF16(IDS_GET_MORE_EXTENSIONS) +
- ASCIIToUTF16("</a>"));
+ ASCIIToUTF16(google_util::AppendGoogleLocaleParam(
+ GURL(Extension::ChromeStoreLaunchURL())).spec()) +
+ ASCIIToUTF16("'>") +
+ l10n_util::GetStringUTF16(IDS_GET_MORE_EXTENSIONS) +
+ ASCIIToUTF16("</a>"));
localized_strings.SetString("extensionDisabled",
l10n_util::GetStringUTF16(IDS_EXTENSIONS_DISABLED_EXTENSION));
localized_strings.SetString("inDevelopment",
diff --git a/chrome/common/extensions/extension.cc b/chrome/common/extensions/extension.cc
index 752b051..bdf130e 100644
--- a/chrome/common/extensions/extension.cc
+++ b/chrome/common/extensions/extension.cc
@@ -1813,7 +1813,7 @@ bool Extension::InitFromValue(const DictionaryValue& source, bool require_key,
}
// static
-std::string Extension::ChromeStoreURL() {
+std::string Extension::ChromeStoreLaunchURL() {
std::string gallery_prefix = extension_urls::kGalleryBrowsePrefix;
if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kAppsGalleryURL))
gallery_prefix = CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
@@ -1827,7 +1827,10 @@ GURL Extension::GalleryUrl() const {
if (!update_url_.DomainIs("google.com"))
return GURL();
- GURL url(ChromeStoreURL() + std::string("/detail/") + id());
+ // TODO(erikkay): This may not be entirely correct with the webstore.
+ // I think it will have a mixture of /extensions/detail and /webstore/detail
+ // URLs. Perhaps they'll handle this nicely with redirects?
+ GURL url(ChromeStoreLaunchURL() + std::string("/detail/") + id());
return url;
}
@@ -2061,7 +2064,9 @@ bool Extension::CanExecuteScriptOnPage(
// The gallery is special-cased as a restricted URL for scripting to prevent
// access to special JS bindings we expose to the gallery (and avoid things
// like extensions removing the "report abuse" link).
- if ((page_url.host() == GURL(Extension::ChromeStoreURL()).host()) &&
+ // TODO(erikkay): This seems like the wrong test. Shouldn't we we testing
+ // against the store app extent?
+ if ((page_url.host() == GURL(Extension::ChromeStoreLaunchURL()).host()) &&
!can_execute_script_everywhere &&
!CommandLine::ForCurrentProcess()->HasSwitch(
switches::kAllowScriptingGallery)) {
diff --git a/chrome/common/extensions/extension.h b/chrome/common/extensions/extension.h
index 8190b3c..ab9acbd 100644
--- a/chrome/common/extensions/extension.h
+++ b/chrome/common/extensions/extension.h
@@ -305,10 +305,12 @@ class Extension {
// it was explicitly turned on via a command line switch).
static bool AppsAreEnabled();
- // Returns the url prefix for the extension/apps gallery. Can be set via the
+ // Returns the launch URL for the extension/apps gallery. Can be set via the
// --apps-gallery-url switch. The URL returned will not contain a trailing
- // slash.
- static std::string ChromeStoreURL();
+ // slash. Do not use this as a prefix/extent for the store. Instead see
+ // ExtensionsService::GetWebStoreApp or
+ // ExtensionsService::IsDownloadFromGallery
+ static std::string ChromeStoreLaunchURL();
// Helper function that consolidates the check for whether the script can
// execute into one location. |page_url| is the page that is the candidate
generated by cgit v1.1 at 2025-01-16 02:19:36 +0000