Code: bool UnpackOriginPermissions(const std::vector<std::string>& origins_input,
                             const PermissionSet& required_permissions,
                             const PermissionSet& optional_permissions,
                             bool allow_file_access,
                             UnpackPermissionSetResult* result,
                             std::string* error) {
  int user_script_schemes = UserScript::ValidUserScriptSchemes();
  int explicit_schemes = Extension::kValidHostPermissionSchemes;
  if (!allow_file_access) {
    user_script_schemes &= ~URLPattern::SCHEME_FILE;
     explicit_schemes &= ~URLPattern::SCHEME_FILE;
   }
 
   for (const auto& origin_str : origins_input) {
     URLPattern explicit_origin(explicit_schemes);
     URLPattern::ParseResult parse_result = explicit_origin.Parse(origin_str);
    if (URLPattern::ParseResult::kSuccess != parse_result) {
      *error = ErrorUtils::FormatErrorMessage(
          kInvalidOrigin, origin_str,
          URLPattern::GetParseResultString(parse_result));
       return false;
     }
 
     bool used_origin = false;
     if (required_permissions.explicit_hosts().ContainsPattern(
             explicit_origin)) {
      used_origin = true;
      result->required_explicit_hosts.AddPattern(explicit_origin);
    } else if (optional_permissions.explicit_hosts().ContainsPattern(
                   explicit_origin)) {
      used_origin = true;
      result->optional_explicit_hosts.AddPattern(explicit_origin);
    }
 
     URLPattern scriptable_origin(user_script_schemes);
     if (scriptable_origin.Parse(origin_str) ==
            URLPattern::ParseResult::kSuccess &&
        required_permissions.scriptable_hosts().ContainsPattern(
            scriptable_origin)) {
      used_origin = true;
      result->required_scriptable_hosts.AddPattern(scriptable_origin);
     }
 
     if (!used_origin)
      result->unlisted_hosts.AddPattern(explicit_origin);
  }

  return true;
}

Vulnerability Type: XSS Bypass 
CWE ID: CWE-79
Summary: A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to bypass extension permission checks for privileged pages via a crafted Chrome Extension.
Commit Message: [Extensions] Have URLPattern::Contains() properly check schemes

Have URLPattern::Contains() properly check the schemes of the patterns
when evaluating if one pattern contains another. This is important in
order to prevent extensions from requesting chrome:-scheme permissions
via the permissions API when <all_urls> is specified as an optional
permission.

Bug: 859600,918470

Change-Id: If04d945ad0c939e84a80d83502c0f84b6ef0923d
Reviewed-on: https://chromium-review.googlesource.com/c/1396561
Commit-Queue: Devlin <rdevlin.cronin@chromium.org>
Reviewed-by: Karan Bhatia <karandeepb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#621410}