Don't allow sending data URLs to WebUI, unless in a ChromeOS BalloonHost.

chrome/browser/notifications/balloon_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/notifications/balloon_host.h"
 
 #include "chrome/browser/notifications/balloon.h"
 #include "chrome/browser/notifications/balloon_collection_impl.h"
 #include "chrome/browser/notifications/notification.h"
 #include "chrome/browser/profiles/profile.h"
@@ skipping 148 matching lines @@
   should_notify_on_disconnect_ = false;
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_NOTIFY_BALLOON_DISCONNECTED,
       content::Source<BalloonHost>(this),
       content::NotificationService::NoDetails());
 }
 
 bool BalloonHost::IsRenderViewReady() const {
   return should_notify_on_disconnect_;
 }
+
+bool BalloonHost::CanLoadDataURLsInWebUI() const {
+#if defined(OS_CHROMEOS)
+  // Chrome OS uses data URLs in WebUI BalloonHosts.  We normally do not allow
+  // data URLs in WebUI renderers, but normal pages cannot target BalloonHosts,
+  // so this should be safe.
+  return true;
+#else
+  return false;
+#endif
+}