Remove apps and themes from kHardcodedPartOfCorbAllowlist.

CORB doesn't impact:
- Chrome Apps (which are explicitly excluded by
  DoContentScriptsDependOnRelaxedCorb function in
  //extensions/browser/url_loader_factory_manager.cc)
- Chrome Hosted Apps and Chrome Themes (which are both unable to perform
  cross-origin requests from content scripts)

Nevertheless, entries in the kHardcodedPartOfCorbAllowlist accidentally
included entries which corresponded to apps and/or themes.  This is
somewhat expected given the design of RAPPOR data gathering pipeline
which (in an attempt to protect private of Chrome users) noisifies the
data and can return false positives (this is especially expected in
cases where the set of all expected values is now known - we know
extensions in the Chrome Web Store, but we can't account for extension
ids corresponding to extensions under development or not published
through the public store).  See also:
- https://www.chromium.org/developers/design-documents/rappor
- (internal, Google-only) go/rappor101 which describes this
  problem in the "3.2 Limitations" section.

Because of the above, we used Chrome Web Store metadata to classify
items on kHardcodedPartOfCorbAllowlist as either extension, app,
platform_app or theme and removed all non-extension items from the
allowlist.

Bug: 846346
Change-Id: I45fd9437f3dae9b57d6f5d1ae79f389b5a528bbc
Reviewed-on: https://chromium-review.googlesource.com/c/1407604
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Commit-Queue: Ɓukasz Anforowicz <lukasza@chromium.org>
Cr-Commit-Position: refs/heads/master@{#622227}
1 file changed