Don't allow sending data URLs to WebUI, unless in a ChromeOS BalloonHost.

chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/chrome_web_ui_controller_factory.h"
 
 #include "base/command_line.h"
 #include "chrome/browser/about_flags.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/extensions/extension_service.h"
@@ skipping 376 matching lines @@
   // Extensions are rendered via WebUI in tabs, but don't actually need WebUI
   // bindings (see the ExtensionWebUI constructor).
   return !NeedsExtensionWebUI(NULL,
                               Profile::FromBrowserContext(browser_context),
                               url) &&
       UseWebUIForURL(browser_context, url);
 }
 
 bool ChromeWebUIControllerFactory::IsURLAcceptableForWebUI(
     content::BrowserContext* browser_context,
-    const GURL& url) const {
+    const GURL& url,
+    bool data_urls_allowed) const {
   return UseWebUIForURL(browser_context, url) ||
       // javacsript: URLs are allowed to run in Web UI pages
       url.SchemeIs(chrome::kJavaScriptScheme) ||
       // It's possible to load about:blank in a Web UI renderer.
       // See http://crbug.com/42547
       url.spec() == chrome::kAboutBlankURL ||
       // Chrome URLs crash, kill, hang, and shorthang are allowed.
       url == GURL(chrome::kChromeUICrashURL) ||
       url == GURL(chrome::kChromeUIKillURL) ||
       url == GURL(chrome::kChromeUIHangURL) ||
-      url == GURL(chrome::kChromeUIShorthangURL);
+      url == GURL(chrome::kChromeUIShorthangURL) ||
+      // Data URLs are usually not allowed in WebUI for security reasons.
+      // BalloonHosts are one exception needed by ChromeOS, and are safe because
+      // they cannot be scripted by other pages.
+      (data_urls_allowed && url.SchemeIs(chrome::kDataScheme));
 }
 
 WebUIController* ChromeWebUIControllerFactory::CreateWebUIControllerForURL(
     content::WebUI* web_ui,
     const GURL& url) const {
   Profile* profile = Profile::FromWebUI(web_ui);
   WebUIFactoryFunction function = GetWebUIFactoryFunction(web_ui, profile, url);
   if (!function)
     return NULL;
 
@@ skipping 81 matching lines @@
   if (page_url.host() == chrome::kChromeUISettingsFrameHost)
     return options2::OptionsUI::GetFaviconResourceBytes();
 
   // Android doesn't use the plugins pages.
   if (page_url.host() == chrome::kChromeUIPluginsHost)
     return PluginsUI::GetFaviconResourceBytes();
 #endif
 
   return NULL;
 }