chrome/common/extensions/chrome_extensions_client.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/common/extensions/chrome_extensions_client.h"
   6
   7 #include "base/command_line.h"
   8 #include "base/files/file_path.h"
   9 #include "base/strings/string_util.h"
  10 #include "base/values.h"
  11 #include "chrome/common/chrome_switches.h"
  12 #include "chrome/common/chrome_version_info.h"
  13 #include "chrome/common/extensions/api/extension_action/action_info.h"
  14 #include "chrome/common/extensions/api/generated_schemas.h"
  15 #include "chrome/common/extensions/chrome_manifest_handlers.h"
  16 #include "chrome/common/extensions/extension_constants.h"
  17 #include "chrome/common/extensions/features/chrome_channel_feature_filter.h"
  18 #include "chrome/common/extensions/features/feature_channel.h"
  19 #include "chrome/common/extensions/manifest_handlers/theme_handler.h"
  20 #include "chrome/common/url_constants.h"
  21 #include "chrome/grit/chromium_strings.h"
  22 #include "chrome/grit/common_resources.h"
  23 #include "chrome/grit/extensions_api_resources.h"
  24 #include "chrome/grit/generated_resources.h"
  25 #include "content/public/common/url_constants.h"
  26 #include "extensions/common/api/generated_schemas.h"
  27 #include "extensions/common/common_manifest_handlers.h"
  28 #include "extensions/common/constants.h"
  29 #include "extensions/common/extension.h"
  30 #include "extensions/common/extension_api.h"
  31 #include "extensions/common/extension_icon_set.h"
  32 #include "extensions/common/extension_urls.h"
  33 #include "extensions/common/features/api_feature.h"
  34 #include "extensions/common/features/base_feature_provider.h"
  35 #include "extensions/common/features/behavior_feature.h"
  36 #include "extensions/common/features/feature_provider.h"
  37 #include "extensions/common/features/json_feature_provider_source.h"
  38 #include "extensions/common/features/manifest_feature.h"
  39 #include "extensions/common/features/permission_feature.h"
  40 #include "extensions/common/features/simple_feature.h"
  41 #include "extensions/common/manifest_constants.h"
  42 #include "extensions/common/manifest_handler.h"
  43 #include "extensions/common/manifest_handlers/icons_handler.h"
  44 #include "extensions/common/permissions/api_permission_set.h"
  45 #include "extensions/common/permissions/permission_message.h"
  46 #include "extensions/common/permissions/permissions_info.h"
  47 #include "extensions/common/url_pattern.h"
  48 #include "extensions/common/url_pattern_set.h"
  49 #include "extensions/grit/extensions_resources.h"
  50 #include "ui/base/l10n/l10n_util.h"
  51 #include "url/gurl.h"
  52
  53 namespace extensions {
  54
  55 namespace {
  56
  57 // TODO(battre): Delete the HTTP URL once the blacklist is downloaded via HTTPS.
  58 const char kExtensionBlocklistUrlPrefix[] =
  59     "http://www.gstatic.com/chrome/extensions/blacklist";
  60 const char kExtensionBlocklistHttpsUrlPrefix[] =
  61     "https://www.gstatic.com/chrome/extensions/blacklist";
  62
  63 const char kThumbsWhiteListedExtension[] = "khopmbdjffemhegeeobelklnbglcdgfh";
  64
  65 template <class FeatureClass>
  66 SimpleFeature* CreateFeature() {
  67   SimpleFeature* feature = new FeatureClass;
  68   feature->AddFilter(
  69       scoped_ptr<SimpleFeatureFilter>(new ChromeChannelFeatureFilter(feature)));
  70   return feature;
  71 }
  72
  73 }  // namespace
  74
  75 static base::LazyInstance<ChromeExtensionsClient> g_client =
  76     LAZY_INSTANCE_INITIALIZER;
  77
  78 ChromeExtensionsClient::ChromeExtensionsClient()
  79     : chrome_api_permissions_(ChromeAPIPermissions()),
  80       extensions_api_permissions_(ExtensionsAPIPermissions()) {
  81 }
  82
  83 ChromeExtensionsClient::~ChromeExtensionsClient() {
  84 }
  85
  86 void ChromeExtensionsClient::Initialize() {
  87   // Registration could already be finalized in unit tests, where the utility
  88   // thread runs in-process.
  89   if (!ManifestHandler::IsRegistrationFinalized()) {
  90     RegisterCommonManifestHandlers();
  91     RegisterChromeManifestHandlers();
  92     ManifestHandler::FinalizeRegistration();
  93   }
  94
  95   // Set up permissions.
  96   PermissionsInfo::GetInstance()->AddProvider(chrome_api_permissions_);
  97   PermissionsInfo::GetInstance()->AddProvider(extensions_api_permissions_);
  98
  99   // Set up the scripting whitelist.
 100   // Whitelist ChromeVox, an accessibility extension from Google that needs
 101   // the ability to script webui pages. This is temporary and is not
 102   // meant to be a general solution.
 103   // TODO(dmazzoni): remove this once we have an extension API that
 104   // allows any extension to request read-only access to webui pages.
 105   scripting_whitelist_.push_back(extension_misc::kChromeVoxExtensionId);
 106
 107   // Whitelist "Discover DevTools Companion" extension from Google that
 108   // needs the ability to script DevTools pages. Companion will assist
 109   // online courses and will be needed while the online educational programs
 110   // are in place.
 111   scripting_whitelist_.push_back("angkfkebojeancgemegoedelbnjgcgme");
 112 }
 113
 114 const PermissionMessageProvider&
 115 ChromeExtensionsClient::GetPermissionMessageProvider() const {
 116   return permission_message_provider_;
 117 }
 118
 119 const std::string ChromeExtensionsClient::GetProductName() {
 120   return l10n_util::GetStringUTF8(IDS_PRODUCT_NAME);
 121 }
 122
 123 scoped_ptr<FeatureProvider> ChromeExtensionsClient::CreateFeatureProvider(
 124     const std::string& name) const {
 125   scoped_ptr<FeatureProvider> provider;
 126   scoped_ptr<JSONFeatureProviderSource> source(
 127       CreateFeatureProviderSource(name));
 128   if (name == "api") {
 129     provider.reset(new BaseFeatureProvider(source->dictionary(),
 130                                            CreateFeature<APIFeature>));
 131   } else if (name == "manifest") {
 132     provider.reset(new BaseFeatureProvider(source->dictionary(),
 133                                            CreateFeature<ManifestFeature>));
 134   } else if (name == "permission") {
 135     provider.reset(new BaseFeatureProvider(source->dictionary(),
 136                                            CreateFeature<PermissionFeature>));
 137   } else if (name == "behavior") {
 138     provider.reset(new BaseFeatureProvider(source->dictionary(),
 139                                            CreateFeature<BehaviorFeature>));
 140   } else {
 141     NOTREACHED();
 142   }
 143   return provider.Pass();
 144 }
 145
 146 scoped_ptr<JSONFeatureProviderSource>
 147 ChromeExtensionsClient::CreateFeatureProviderSource(
 148     const std::string& name) const {
 149   scoped_ptr<JSONFeatureProviderSource> source(
 150       new JSONFeatureProviderSource(name));
 151   if (name == "api") {
 152     source->LoadJSON(IDR_EXTENSION_API_FEATURES);
 153     source->LoadJSON(IDR_CHROME_EXTENSION_API_FEATURES);
 154   } else if (name == "manifest") {
 155     source->LoadJSON(IDR_EXTENSION_MANIFEST_FEATURES);
 156     source->LoadJSON(IDR_CHROME_EXTENSION_MANIFEST_FEATURES);
 157   } else if (name == "permission") {
 158     source->LoadJSON(IDR_EXTENSION_PERMISSION_FEATURES);
 159     source->LoadJSON(IDR_CHROME_EXTENSION_PERMISSION_FEATURES);
 160   } else if (name == "behavior") {
 161     source->LoadJSON(IDR_EXTENSION_BEHAVIOR_FEATURES);
 162   } else {
 163     NOTREACHED();
 164     source.reset();
 165   }
 166   return source.Pass();
 167 }
 168
 169 void ChromeExtensionsClient::FilterHostPermissions(
 170     const URLPatternSet& hosts,
 171     URLPatternSet* new_hosts,
 172     std::set<PermissionMessage>* messages) const {
 173   // When editing this function, be sure to add the same functionality to
 174   // FilterHostPermissions() below.
 175   // TODO(sashab): Deprecate and remove this function.
 176   for (URLPatternSet::const_iterator i = hosts.begin();
 177        i != hosts.end(); ++i) {
 178     // Filters out every URL pattern that matches chrome:// scheme.
 179     if (i->scheme() == content::kChromeUIScheme) {
 180       // chrome://favicon is the only URL for chrome:// scheme that we
 181       // want to support. We want to deprecate the "chrome" scheme.
 182       // We should not add any additional "host" here.
 183       if (GURL(chrome::kChromeUIFaviconURL).host() != i->host())
 184         continue;
 185       messages->insert(PermissionMessage(
 186           PermissionMessage::kFavicon,
 187           l10n_util::GetStringUTF16(IDS_EXTENSION_PROMPT_WARNING_FAVICON)));
 188     } else {
 189       new_hosts->AddPattern(*i);
 190     }
 191   }
 192 }
 193
 194 void ChromeExtensionsClient::FilterHostPermissions(
 195     const URLPatternSet& hosts,
 196     URLPatternSet* new_hosts,
 197     PermissionIDSet* permissions) const {
 198   // When editing this function, be sure to add the same functionality to
 199   // FilterHostPermissions() above.
 200   for (URLPatternSet::const_iterator i = hosts.begin(); i != hosts.end(); ++i) {
 201     // Filters out every URL pattern that matches chrome:// scheme.
 202     if (i->scheme() == content::kChromeUIScheme) {
 203       // chrome://favicon is the only URL for chrome:// scheme that we
 204       // want to support. We want to deprecate the "chrome" scheme.
 205       // We should not add any additional "host" here.
 206       if (GURL(chrome::kChromeUIFaviconURL).host() != i->host())
 207         continue;
 208       // TODO(sashab): Add the rule
 209       // kFavicon -> IDS_EXTENSION_PROMPT_WARNING_FAVICON
 210       // to ChromePermissionMessageProvider.
 211       permissions->insert(APIPermission::kFavicon);
 212     } else {
 213       new_hosts->AddPattern(*i);
 214     }
 215   }
 216 }
 217
 218 void ChromeExtensionsClient::SetScriptingWhitelist(
 219     const ExtensionsClient::ScriptingWhitelist& whitelist) {
 220   scripting_whitelist_ = whitelist;
 221 }
 222
 223 const ExtensionsClient::ScriptingWhitelist&
 224 ChromeExtensionsClient::GetScriptingWhitelist() const {
 225   return scripting_whitelist_;
 226 }
 227
 228 URLPatternSet ChromeExtensionsClient::GetPermittedChromeSchemeHosts(
 229       const Extension* extension,
 230       const APIPermissionSet& api_permissions) const {
 231   URLPatternSet hosts;
 232   // Regular extensions are only allowed access to chrome://favicon.
 233   hosts.AddPattern(URLPattern(URLPattern::SCHEME_CHROMEUI,
 234                               chrome::kChromeUIFaviconURL));
 235
 236   // Experimental extensions are also allowed chrome://thumb.
 237   //
 238   // TODO: A public API should be created for retrieving thumbnails.
 239   // See http://crbug.com/222856. A temporary hack is implemented here to
 240   // make chrome://thumbs available to NTP Russia extension as
 241   // non-experimental.
 242   if ((api_permissions.find(APIPermission::kExperimental) !=
 243        api_permissions.end()) ||
 244       (extension->id() == kThumbsWhiteListedExtension &&
 245        extension->from_webstore())) {
 246     hosts.AddPattern(URLPattern(URLPattern::SCHEME_CHROMEUI,
 247                                 chrome::kChromeUIThumbnailURL));
 248   }
 249   return hosts;
 250 }
 251
 252 bool ChromeExtensionsClient::IsScriptableURL(
 253     const GURL& url, std::string* error) const {
 254   // The gallery is special-cased as a restricted URL for scripting to prevent
 255   // access to special JS bindings we expose to the gallery (and avoid things
 256   // like extensions removing the "report abuse" link).
 257   // TODO(erikkay): This seems like the wrong test.  Shouldn't we we testing
 258   // against the store app extent?
 259   GURL store_url(extension_urls::GetWebstoreLaunchURL());
 260   if (url.host() == store_url.host()) {
 261     if (error)
 262       *error = manifest_errors::kCannotScriptGallery;
 263     return false;
 264   }
 265   return true;
 266 }
 267
 268 bool ChromeExtensionsClient::IsAPISchemaGenerated(
 269     const std::string& name) const {
 270   // Test from most common to least common.
 271   return api::GeneratedSchemas::IsGenerated(name) ||
 272          core_api::GeneratedSchemas::IsGenerated(name);
 273 }
 274
 275 base::StringPiece ChromeExtensionsClient::GetAPISchema(
 276     const std::string& name) const {
 277   // Test from most common to least common.
 278   if (api::GeneratedSchemas::IsGenerated(name))
 279     return api::GeneratedSchemas::Get(name);
 280
 281   return core_api::GeneratedSchemas::Get(name);
 282 }
 283
 284 void ChromeExtensionsClient::RegisterAPISchemaResources(
 285     ExtensionAPI* api) const {
 286   api->RegisterSchemaResource("accessibilityPrivate",
 287                               IDR_EXTENSION_API_JSON_ACCESSIBILITYPRIVATE);
 288   api->RegisterSchemaResource("app", IDR_EXTENSION_API_JSON_APP);
 289   api->RegisterSchemaResource("browserAction",
 290                               IDR_EXTENSION_API_JSON_BROWSERACTION);
 291   api->RegisterSchemaResource("commands", IDR_EXTENSION_API_JSON_COMMANDS);
 292   api->RegisterSchemaResource("declarativeContent",
 293                               IDR_EXTENSION_API_JSON_DECLARATIVE_CONTENT);
 294   api->RegisterSchemaResource("fileBrowserHandler",
 295                               IDR_EXTENSION_API_JSON_FILEBROWSERHANDLER);
 296   api->RegisterSchemaResource("inputMethodPrivate",
 297                               IDR_EXTENSION_API_JSON_INPUTMETHODPRIVATE);
 298   api->RegisterSchemaResource("pageAction", IDR_EXTENSION_API_JSON_PAGEACTION);
 299   api->RegisterSchemaResource("privacy", IDR_EXTENSION_API_JSON_PRIVACY);
 300   api->RegisterSchemaResource("processes", IDR_EXTENSION_API_JSON_PROCESSES);
 301   api->RegisterSchemaResource("proxy", IDR_EXTENSION_API_JSON_PROXY);
 302   api->RegisterSchemaResource("ttsEngine", IDR_EXTENSION_API_JSON_TTSENGINE);
 303   api->RegisterSchemaResource("tts", IDR_EXTENSION_API_JSON_TTS);
 304   api->RegisterSchemaResource("types", IDR_EXTENSION_API_JSON_TYPES);
 305   api->RegisterSchemaResource("types.private",
 306                               IDR_EXTENSION_API_JSON_TYPES_PRIVATE);
 307   api->RegisterSchemaResource("webstore", IDR_EXTENSION_API_JSON_WEBSTORE);
 308 }
 309
 310 bool ChromeExtensionsClient::ShouldSuppressFatalErrors() const {
 311   // Suppress fatal errors only on beta and stable channels.
 312   return GetCurrentChannel() > chrome::VersionInfo::CHANNEL_DEV;
 313 }
 314
 315 std::string ChromeExtensionsClient::GetWebstoreBaseURL() const {
 316   std::string gallery_prefix = extension_urls::kChromeWebstoreBaseURL;
 317   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
 318           switches::kAppsGalleryURL))
 319     gallery_prefix =
 320         base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
 321             switches::kAppsGalleryURL);
 322   if (EndsWith(gallery_prefix, "/", true))
 323     gallery_prefix = gallery_prefix.substr(0, gallery_prefix.length() - 1);
 324   return gallery_prefix;
 325 }
 326
 327 std::string ChromeExtensionsClient::GetWebstoreUpdateURL() const {
 328   base::CommandLine* cmdline = base::CommandLine::ForCurrentProcess();
 329   if (cmdline->HasSwitch(switches::kAppsGalleryUpdateURL))
 330     return cmdline->GetSwitchValueASCII(switches::kAppsGalleryUpdateURL);
 331   else
 332     return extension_urls::GetDefaultWebstoreUpdateUrl().spec();
 333 }
 334
 335 bool ChromeExtensionsClient::IsBlacklistUpdateURL(const GURL& url) const {
 336   // The extension blacklist URL is returned from the update service and
 337   // therefore not determined by Chromium. If the location of the blacklist file
 338   // ever changes, we need to update this function. A DCHECK in the
 339   // ExtensionUpdater ensures that we notice a change. This is the full URL
 340   // of a blacklist:
 341   // http://www.gstatic.com/chrome/extensions/blacklist/l_0_0_0_7.txt
 342   return StartsWithASCII(url.spec(), kExtensionBlocklistUrlPrefix, true) ||
 343          StartsWithASCII(url.spec(), kExtensionBlocklistHttpsUrlPrefix, true);
 344 }
 345
 346 std::set<base::FilePath> ChromeExtensionsClient::GetBrowserImagePaths(
 347     const Extension* extension) {
 348   std::set<base::FilePath> image_paths =
 349       ExtensionsClient::GetBrowserImagePaths(extension);
 350
 351   // Theme images
 352   const base::DictionaryValue* theme_images =
 353       extensions::ThemeInfo::GetImages(extension);
 354   if (theme_images) {
 355     for (base::DictionaryValue::Iterator it(*theme_images); !it.IsAtEnd();
 356          it.Advance()) {
 357       base::FilePath::StringType path;
 358       if (it.value().GetAsString(&path))
 359         image_paths.insert(base::FilePath(path));
 360     }
 361   }
 362
 363   const extensions::ActionInfo* page_action =
 364       extensions::ActionInfo::GetPageActionInfo(extension);
 365   if (page_action && !page_action->default_icon.empty())
 366     page_action->default_icon.GetPaths(&image_paths);
 367
 368   const extensions::ActionInfo* browser_action =
 369       extensions::ActionInfo::GetBrowserActionInfo(extension);
 370   if (browser_action && !browser_action->default_icon.empty())
 371     browser_action->default_icon.GetPaths(&image_paths);
 372
 373   return image_paths;
 374 }
 375
 376 // static
 377 ChromeExtensionsClient* ChromeExtensionsClient::GetInstance() {
 378   return g_client.Pointer();
 379 }
 380
 381 }  // namespace extensions