Do not pass URLs in onUpdated events to extensions unless they have the

chrome/browser/extensions/browser_event_router.cc

Index: chrome/browser/extensions/browser_event_router.cc
diff --git a/chrome/browser/extensions/browser_event_router.cc b/chrome/browser/extensions/browser_event_router.cc
index 7b38ef9d15ff2051d646613892928bc518310c53..e647b8f5ce14845a78c1385d8055f7628d64bf17 100644
--- a/chrome/browser/extensions/browser_event_router.cc
+++ b/chrome/browser/extensions/browser_event_router.cc
@@ -339,17 +339,17 @@ void BrowserEventRouter::TabMoved(WebContents* contents,
 
 void BrowserEventRouter::TabUpdated(WebContents* contents, bool did_navigate) {
   TabEntry* entry = GetTabEntry(contents);
-  DictionaryValue* changed_properties = NULL;
+  scoped_ptr<DictionaryValue> changed_properties;
 
   DCHECK(entry);
 
   if (did_navigate)
-    changed_properties = entry->DidNavigate(contents);
+    changed_properties.reset(entry->DidNavigate(contents));
   else
-    changed_properties = entry->UpdateLoadState(contents);
+    changed_properties.reset(entry->UpdateLoadState(contents));
 
   if (changed_properties)
-    DispatchTabUpdatedEvent(contents, changed_properties);
+    DispatchTabUpdatedEvent(contents, changed_properties.Pass());
 }
 
 void BrowserEventRouter::DispatchEvent(
@@ -396,18 +396,27 @@ void BrowserEventRouter::DispatchSimpleBrowserEvent(
                 EventRouter::USER_GESTURE_UNKNOWN);
 }
 
-static void WillDispatchTabUpdatedEvent(WebContents* contents,
-                                        Profile* profile,
-                                        const Extension* extension,
-                                        ListValue* event_args) {
+static void WillDispatchTabUpdatedEvent(
+    WebContents* contents,
+    const DictionaryValue* changed_properties,
+    Profile* profile,
+    const Extension* extension,
+    ListValue* event_args) {
+  // Overwrite the second argument with the appropriate properties dictionary,
+  // depending on extension permissions.
+  DictionaryValue* properties_value = changed_properties->DeepCopy();
+  ExtensionTabUtil::ScrubTabValueForExtension(contents, extension,
+                                              properties_value);
+  event_args->Set(1, properties_value);
+
+  // Overwrite the third arg with our tab value as seen by this extension.
   DictionaryValue* tab_value = ExtensionTabUtil::CreateTabValue(
       contents, extension);
-  // Overwrite the third arg with our tab value as seen by this extension.
   event_args->Set(2, tab_value);
 }
 
 void BrowserEventRouter::DispatchTabUpdatedEvent(
-    WebContents* contents, DictionaryValue* changed_properties) {
+    WebContents* contents, scoped_ptr<DictionaryValue> changed_properties) {
   DCHECK(changed_properties);
   DCHECK(contents);
 
@@ -418,8 +427,9 @@ void BrowserEventRouter::DispatchTabUpdatedEvent(
   // First arg: The id of the tab that changed.
   args_base->AppendInteger(ExtensionTabUtil::GetTabId(contents));
 
-  // Second arg: An object containing the changes to the tab state.
-  args_base->Append(changed_properties);
+  // Second arg: An object containing the changes to the tab state.  Filled in
+  // by WillDispatchTabUpdatedEvent as a copy of changed_properties, if the
+  // extension has the tabs permission.
 
   // Third arg: An object containing the state of the tab. Filled in by
   // WillDispatchTabUpdatedEvent.
@@ -429,7 +439,8 @@ void BrowserEventRouter::DispatchTabUpdatedEvent(
   event->restrict_to_profile = profile;
   event->user_gesture = EventRouter::USER_GESTURE_NOT_ENABLED;
   event->will_dispatch_callback =
-      base::Bind(&WillDispatchTabUpdatedEvent, contents);
+      base::Bind(&WillDispatchTabUpdatedEvent,
+                 contents, changed_properties.get());
   ExtensionSystem::Get(profile)->event_router()->BroadcastEvent(event.Pass());
 }
 
@@ -501,10 +512,10 @@ void BrowserEventRouter::TabPinnedStateChanged(WebContents* contents,
   int tab_index;
 
   if (ExtensionTabUtil::GetTabStripModel(contents, &tab_strip, &tab_index)) {
-    DictionaryValue* changed_properties = new DictionaryValue();
+    scoped_ptr<DictionaryValue> changed_properties(new DictionaryValue());
     changed_properties->SetBoolean(tab_keys::kPinnedKey,
                                    tab_strip->IsTabPinned(tab_index));
-    DispatchTabUpdatedEvent(contents, changed_properties);
+    DispatchTabUpdatedEvent(contents, changed_properties.Pass());
   }
 }
 
@@ -591,8 +602,7 @@ void BrowserEventRouter::ExtensionActionExecuted(
   if (event_name) {
     scoped_ptr<ListValue> args(new ListValue());
     DictionaryValue* tab_value = ExtensionTabUtil::CreateTabValue(
-        web_contents,
-        ExtensionTabUtil::INCLUDE_PRIVACY_SENSITIVE_FIELDS);
+        web_contents);
     args->Append(tab_value);
 
     DispatchEventToExtension(profile,