commit 74fbde045a78e44dba67fa256e39b2180212723a
author Devlin Cronin <rdevlin.cronin@chromium.org> Fri Jun 24 17:10:03 2022
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Fri Jun 24 17:10:03 2022
tree 3d2a0913ea2fffd718b31ff291110c3753e80f43
parent d573b5ffde1d4689693fcbba9c4e4f052e69d5ee

[Extensions] Set user host restrictions in the network layer

Include user host restrictions in the network layer. This entails
modifying the cors/corb origin access / blocklists with the user-
specified hosts.

This is a little complex because the network layer doesn't know about
extensions and abstracts out the idea of the access and block lists,
which already exist for policy-installed extensions. Currently, the
hierarchy of the lists is:

Chrome Restricted Sites >
    Enterprise Allowed Sites >
    Enterprise Blocked Sites >
    Extension Requested Sites

Enterprise allowed sites take precedence over enterprise blocked sites
so enterprises can specify exceptions to permissions patterns. Adding
in user restrictions, this becomes:

Chrome Restricted Sites >
    User Restricted Sites >
    Enterprise Allowed Sites >
    Enterprise Blocked Sites >
    Extension Requested Sites

We don't add user allowed sites because there should (currently) be no
overlap with user blocked sites. User restricted sites take priority
over enterprise allowed sites because an enterprise allowed site entry
indicates extensions *may* run on certain sites, but not that they
*must*; thus, users should still be able to restrict these. Note that
user host restrictions don't apply to policy-installed (or component)
extensions, so the user is unable to override policy-installed
extensions' permissions.

Add new tests for user restricted sites being enforced in the network
layer (which affects an extension's ability to fetch cross-origin
resources) and checking that a user allowed site does not override
enterprise blocked sites.

Bug: 1268198
Change-Id: I1c71bd23d20af16c9b29cafa8234130fe08315ea
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3703714
Reviewed-by: Emilia Paz <emiliapaz@chromium.org>
Commit-Queue: Devlin Cronin <rdevlin.cronin@chromium.org>
Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1017699}