Code: void MessageService::OpenChannelToNativeApp(
    int source_process_id,
    int source_routing_id,
    int receiver_port_id,
    const std::string& source_extension_id,
    const std::string& native_app_name,
    const std::string& channel_name,
    const std::string& connect_message) {
  content::RenderProcessHost* source =
      content::RenderProcessHost::FromID(source_process_id);
  if (!source)
    return;

  WebContents* source_contents = tab_util::GetWebContentsByID(
      source_process_id, source_routing_id);

   std::string tab_json = "null";
   if (source_contents) {
     scoped_ptr<DictionaryValue> tab_value(ExtensionTabUtil::CreateTabValue(
        source_contents, ExtensionTabUtil::INCLUDE_PRIVACY_SENSITIVE_FIELDS));
     base::JSONWriter::Write(tab_value.get(), &tab_json);
   }
 
  scoped_ptr<MessageChannel> channel(new MessageChannel());
  channel->opener.reset(new ExtensionMessagePort(source, MSG_ROUTING_CONTROL,
                                                 source_extension_id));

  NativeMessageProcessHost::MessageType type =
      channel_name == "chrome.runtime.sendNativeMessage" ?
      NativeMessageProcessHost::TYPE_SEND_MESSAGE_REQUEST :
      NativeMessageProcessHost::TYPE_CONNECT;

  content::BrowserThread::PostTask(
      content::BrowserThread::FILE,
      FROM_HERE,
      base::Bind(&NativeMessageProcessHost::Create,
                 base::WeakPtr<NativeMessageProcessHost::Client>(
                    weak_factory_.GetWeakPtr()),
                 native_app_name, connect_message, receiver_port_id,
                 type,
                 base::Bind(&MessageService::FinalizeOpenChannelToNativeApp,
                            weak_factory_.GetWeakPtr(),
                            receiver_port_id,
                            channel_name,
                            base::Passed(&channel),
                            tab_json)));
}

Vulnerability Type: 
CWE ID: CWE-264
Summary: Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka APIPermission::kTab) permission before providing a URL to this extension, which has unspecified impact and remote attack vectors.
Commit Message: Do not pass URLs in onUpdated events to extensions unless they have the
"tabs" permission.

BUG=168442


Review URL: https://chromiumcodereview.appspot.com/11824004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@176406 0039d316-1c4b-4281-b951-d872f2087c98