Code:  bool Extension::HasAPIPermission(const std::string& function_name) const {
   base::AutoLock auto_lock(runtime_data_lock_);
   return runtime_data_.GetActivePermissions()->
      HasAccessToFunction(function_name);
 }

Vulnerability Type: 
CWE ID: CWE-264
Summary: Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict API privileges during interaction with the Chrome Web Store, which has unspecified impact and attack vectors.
Commit Message: Tighten restrictions on hosted apps calling extension APIs

Only allow component apps to make any API calls, and for them only allow the namespaces they explicitly have permission for (plus chrome.test - I need to see if I can rework some WebStore tests to remove even this). 

BUG=172369


Review URL: https://chromiumcodereview.appspot.com/12095095

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@180426 0039d316-1c4b-4281-b951-d872f2087c98