Almost all actions in Declarative Web Request require all_urls host permissions

chrome/browser/extensions/api/web_request/web_request_permissions.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/web_request/web_request_permissions.h"
 
 #include "base/string_util.h"
 #include "base/stringprintf.h"
 #include "chrome/browser/extensions/extension_info_map.h"
 #include "chrome/common/extensions/extension.h"
@@ skipping 79 matching lines @@
   const GURL& url = request->url();
   return IsSensitiveURL(url) || !HasWebRequestScheme(url);
 }
 
 // static
 bool WebRequestPermissions::CanExtensionAccessURL(
     const ExtensionInfoMap* extension_info_map,
     const std::string& extension_id,
     const GURL& url,
     bool crosses_incognito,
-    bool enforce_host_permissions) {
+    HostPermissionsCheck host_permissions_check) {
   // extension_info_map can be NULL in testing.
   if (!extension_info_map)
     return true;
 
   const extensions::Extension* extension =
       extension_info_map->extensions().GetByID(extension_id);
   if (!extension)
     return false;
 
   // Check if this event crosses incognito boundaries when it shouldn't.
   if (crosses_incognito && !extension_info_map->CanCrossIncognito(extension))
     return false;
 
-  if (enforce_host_permissions) {
-    // about: URLs are not covered in host permissions, but are allowed anyway.
-    bool host_permissions_ok = (url.SchemeIs(chrome::kAboutScheme) ||
-                                extension->HasHostPermission(url) ||
-                                url.GetOrigin() == extension->url());
-    if (!host_permissions_ok)
-      return false;
+  switch (host_permissions_check) {
+    case DO_NOT_CHECK_HOST:
+      break;
+    case REQUIRE_HOST_PERMISSION:
+      // about: URLs are not covered in host permissions, but are allowed
+      // anyway.
+      if (!((url.SchemeIs(chrome::kAboutScheme) ||
+             extension->HasHostPermission(url) ||
+             url.GetOrigin() == extension->url())))
+        return false;
+      break;
+    case REQUIRE_ALL_URLS:
+      if (!extension->HasEffectiveAccessToAllHosts())
+        return false;
+      break;
   }
 
   return true;
 }