Home | History | Annotate | Download | only in extensions 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "chrome/browser/extensions/admin_policy.h"
      6 
      7 #include "base/strings/utf_string_conversions.h"
      8 #include "chrome/common/extensions/extension.h"
      9 #include "chrome/common/extensions/manifest.h"
     10 #include "grit/generated_resources.h"
     11 #include "ui/base/l10n/l10n_util.h"
     12 
     13 namespace {
     14 
     15 bool ManagementPolicyImpl(const extensions::Extension* extension,
     16                           string16* error,
     17                           bool modifiable_value) {
     18   bool modifiable =
     19       extension->location() != extensions::Manifest::COMPONENT &&
     20       extension->location() != extensions::Manifest::EXTERNAL_POLICY_DOWNLOAD;
     21   // Some callers equate "no restriction" to true, others to false.
     22   if (modifiable)
     23     return modifiable_value;
     24 
     25   if (error) {
     26     *error = l10n_util::GetStringFUTF16(
     27         IDS_EXTENSION_CANT_MODIFY_POLICY_REQUIRED,
     28         UTF8ToUTF16(extension->name()));
     29   }
     30   return !modifiable_value;
     31 }
     32 
     33 bool ReturnLoadError(const extensions::Extension* extension, string16* error) {
     34   if (error) {
     35     *error = l10n_util::GetStringFUTF16(
     36           IDS_EXTENSION_CANT_INSTALL_POLICY_BLOCKED,
     37           UTF8ToUTF16(extension->name()),
     38           UTF8ToUTF16(extension->id()));
     39   }
     40   return false;
     41 }
     42 
     43 }  // namespace
     44 
     45 namespace extensions {
     46 namespace admin_policy {
     47 
     48 bool BlacklistedByDefault(const base::ListValue* blacklist) {
     49   base::StringValue wildcard("*");
     50   return blacklist && blacklist->Find(wildcard) != blacklist->end();
     51 }
     52 
     53 bool UserMayLoad(const base::ListValue* blacklist,
     54                  const base::ListValue* whitelist,
     55                  const base::DictionaryValue* forcelist,
     56                  const base::ListValue* allowed_types,
     57                  const Extension* extension,
     58                  string16* error) {
     59   // Component extensions are always allowed.
     60   if (extension->location() == Manifest::COMPONENT)
     61     return true;
     62 
     63   // Forced installed extensions cannot be overwritten manually.
     64   if (extension->location() != Manifest::EXTERNAL_POLICY_DOWNLOAD &&
     65       forcelist && forcelist->HasKey(extension->id())) {
     66     return ReturnLoadError(extension, error);
     67   }
     68 
     69   // Early exit for the common case of no policy restrictions.
     70   if ((!blacklist || blacklist->empty()) && (!allowed_types))
     71     return true;
     72 
     73   // Check whether the extension type is allowed.
     74   //
     75   // If you get a compile error here saying that the type you added is not
     76   // handled by the switch statement below, please consider whether enterprise
     77   // policy should be able to disallow extensions of the new type. If so, add a
     78   // branch to the second block and add a line to the definition of
     79   // kExtensionAllowedTypesMap in configuration_policy_handler_list.cc.
     80   switch (extension->GetType()) {
     81     case Manifest::TYPE_UNKNOWN:
     82       break;
     83     case Manifest::TYPE_EXTENSION:
     84     case Manifest::TYPE_THEME:
     85     case Manifest::TYPE_USER_SCRIPT:
     86     case Manifest::TYPE_HOSTED_APP:
     87     case Manifest::TYPE_LEGACY_PACKAGED_APP:
     88     case Manifest::TYPE_PLATFORM_APP:
     89     case Manifest::TYPE_SHARED_MODULE:
     90       base::FundamentalValue type_value(extension->GetType());
     91       if (allowed_types &&
     92           allowed_types->Find(type_value) == allowed_types->end())
     93         return ReturnLoadError(extension, error);
     94       break;
     95   }
     96 
     97   // Check the whitelist/forcelist first.
     98   base::StringValue id_value(extension->id());
     99   if ((whitelist && whitelist->Find(id_value) != whitelist->end()) ||
    100       (forcelist && forcelist->HasKey(extension->id())))
    101     return true;
    102 
    103   // Then check the admin blacklist.
    104   if ((blacklist && blacklist->Find(id_value) != blacklist->end()) ||
    105       BlacklistedByDefault(blacklist))
    106     return ReturnLoadError(extension, error);
    107 
    108   return true;
    109 }
    110 
    111 bool UserMayModifySettings(const Extension* extension, string16* error) {
    112   return ManagementPolicyImpl(extension, error, true);
    113 }
    114 
    115 bool MustRemainEnabled(const Extension* extension, string16* error) {
    116   return ManagementPolicyImpl(extension, error, false);
    117 }
    118 
    119 }  // namespace
    120 }  // namespace
    121