Don't allow sending data URLs to WebUI, unless in a ChromeOS BalloonHost.

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
@@ skipping 1054 matching lines @@
   RenderViewHostImpl* dest_render_view_host =
       static_cast<RenderViewHostImpl*>(render_manager_.Navigate(entry));
   if (!dest_render_view_host)
     return false;  // Unable to create the desired render view host.
 
   // For security, we should never send non-Web-UI URLs to a Web UI renderer.
   // Double check that here.
   int enabled_bindings = dest_render_view_host->GetEnabledBindings();
   WebUIControllerFactory* factory =
       content::GetContentClient()->browser()->GetWebUIControllerFactory();
+  bool data_urls_allowed = delegate_ && delegate_->CanLoadDataURLsInWebUI();
   bool is_allowed_in_web_ui_renderer =
       factory &&
-      factory->IsURLAcceptableForWebUI(GetBrowserContext(), entry.GetURL());
-#if defined(OS_CHROMEOS)
-  is_allowed_in_web_ui_renderer |= entry.GetURL().SchemeIs(chrome::kDataScheme);
-#endif
+      factory->IsURLAcceptableForWebUI(GetBrowserContext(), entry.GetURL(),
+                                       data_urls_allowed);
   if ((enabled_bindings & content::BINDINGS_POLICY_WEB_UI) &&
       !is_allowed_in_web_ui_renderer) {
-    // Log the URL to help us diagnose http://crbug.com/72235.
+    // Log the URL to help us diagnose any future failures of this CHECK.
     content::GetContentClient()->SetActiveURL(entry.GetURL());
     CHECK(0);
   }
 
   // Tell DevTools agent that it is attached prior to the navigation.
   DevToolsManagerImpl::GetInstance()->OnNavigatingToPendingEntry(
       GetRenderViewHost(),
       dest_render_view_host,
       entry.GetURL());
 
@@ skipping 1529 matching lines @@
 void WebContentsImpl::CreateViewAndSetSizeForRVH(RenderViewHost* rvh) {
   RenderWidgetHostView* rwh_view = GetView()->CreateViewForWidget(rvh);
   // Can be NULL during tests.
   if (rwh_view)
     rwh_view->SetSize(GetView()->GetContainerSize());
 }
 
 RenderViewHostImpl* WebContentsImpl::GetRenderViewHostImpl() {
   return static_cast<RenderViewHostImpl*>(GetRenderViewHost());
 }