Translate: cleanup on how to pass api key to the script

Translate: cleanup on how to pass api key to the script

Now that translate.js runs in an isolated world, it is safe to expose
API key as an isolated world global variable.
Of course, reusing this key outside Chrome is not permitted if it's possible:)

BUG=none
TEST=browser_tests --gtest_filter='Translate*.*'

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=217777

[Takashi Toyoshima, 2013-08-12 05:54:06]

Hi Evan,
Can you take a look this?

Presubmit check didn't pass on this file for a long time, because the source was
complemented by C++ code. This change make it pass by passing API key in a
different way.

[Evan Stade, 2013-08-12 15:24:45]

https://codereview.chromium.org/22645015/diff/1/chrome/browser/resources/tran...
File chrome/browser/resources/translate.js (right):

https://codereview.chromium.org/22645015/diff/1/chrome/browser/resources/tran...
chrome/browser/resources/translate.js:270: delete translateApiKey;
what is this supposed to do?

[Takashi Toyoshima, 2013-08-13 01:18:37]

https://codereview.chromium.org/22645015/diff/1/chrome/browser/resources/tran...
File chrome/browser/resources/translate.js (right):

https://codereview.chromium.org/22645015/diff/1/chrome/browser/resources/tran...
chrome/browser/resources/translate.js:270: delete translateApiKey;
"var translateApiKey = '...';\r\n" is injected before the script by the C++
code.
I want to remove the reference of the string once it is used.
This is not needed actually, but just in case so that there is less chance for
attackers to access the key.

[Evan Stade, 2013-08-13 16:35:35]

On 2013/08/13 01:18:37, Takashi Toyoshima (chromium) wrote:
>
https://codereview.chromium.org/22645015/diff/1/chrome/browser/resources/tran...
> File chrome/browser/resources/translate.js (right):
> 
>
https://codereview.chromium.org/22645015/diff/1/chrome/browser/resources/tran...
> chrome/browser/resources/translate.js:270: delete translateApiKey;
> "var translateApiKey = '...';\r\n" is injected before the script by the C++
> code.
> I want to remove the reference of the string once it is used.
> This is not needed actually, but just in case so that there is less chance for
> attackers to access the key.

I'm pretty sure that this does nothing in JavaScript. Try this in the console:

var x = 'foo';
delete x;
x;

[Takashi Toyoshima, 2013-08-14 00:26:27]

In Stable,
> delete x
false

But,

In Canary,
> delete x
true
> x
undefined

So, it works as intended in the latest build.

[Takashi Toyoshima, 2013-08-14 00:28:37]

Ah, sorry. it's wrong.

> var x = 'xxx';
> delete x
false

> y = 'xxx';
> delete y
true

I'll fix it.

[Takashi Toyoshima, 2013-08-14 01:22:38]

Sorry, I was confused.

If I define it as a global variable without var, it can be deleted since it
becomes a attribute of window, window['translateApiKey']. But local variable can
not be deleted.

I change it to assign undefined instead of deleting it.

[Evan Stade, 2013-08-14 21:41:29]

lgtm

[commit-bot: I haz the power, 2013-08-15 01:55:32]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/toyoshim@chromium.org/22645015/17001

[commit-bot: I haz the power, 2013-08-15 05:02:02]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/toyoshim@chromium.org/22645015/17001

[commit-bot: I haz the power, 2013-08-15 05:08:50]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/toyoshim@chromium.org/22645015/44001

[commit-bot: I haz the power, 2013-08-15 11:16:37]

Change committed as 217777