Don't allow sending data URLs to WebUI, unless in a ChromeOS BalloonHost.

content/browser/web_contents/render_view_host_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/render_view_host_manager.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/logging.h"
@@ skipping 357 matching lines @@
   // site, which might already be committed to a Web UI URL (such as the NTP).
   const GURL& current_url = (cur_entry) ? cur_entry->GetURL() :
       render_view_host_->GetSiteInstance()->GetSite();
   content::BrowserContext* browser_context =
       delegate_->GetControllerForRenderManager().GetBrowserContext();
   const WebUIControllerFactory* web_ui_factory =
       content::GetContentClient()->browser()->GetWebUIControllerFactory();
   if (web_ui_factory) {
     if (web_ui_factory->UseWebUIForURL(browser_context, current_url)) {
       // Force swap if it's not an acceptable URL for Web UI.
+      // Here, data URLs are never allowed.
       if (!web_ui_factory->IsURLAcceptableForWebUI(browser_context,
-                                                   new_entry->GetURL()))
+                                                   new_entry->GetURL(), false))
         return true;
     } else {
       // Force swap if it's a Web UI URL.
       if (web_ui_factory->UseWebUIForURL(browser_context, new_entry->GetURL()))
         return true;
     }
   }
 
   if (content::GetContentClient()->browser()->ShouldSwapProcessesForNavigation(
           cur_entry ? cur_entry->GetURL() : GURL(), new_entry->GetURL())) {
@@ skipping 448 matching lines @@
   }
 }
 
 bool RenderViewHostManager::IsSwappedOut(RenderViewHost* rvh) {
   if (!rvh->GetSiteInstance())
     return false;
 
   return swapped_out_hosts_.find(rvh->GetSiteInstance()->GetId()) !=
       swapped_out_hosts_.end();
 }