Prevent chrome from launching with a chromehtml: argument...

Prevent chrome from launching with a chromehtml: argument
unless its preceeded by the switch terminator.  This is to
prevent chromehtml: urls to supply arguments to Chrome.

BUG=5825
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=10684

[Sverrir, 2009-02-18 22:37:44]

After implementing this I had a second thought:  Possibly we should just detect
chromehtml: - there is no reason going  through the hoops I did to detect the --
etc because we don't support this anyway?

If you agree I will simplify the code to just detect chromehtml: and exit. 
I don't think putting up an error box would help here since: A) this is very
unlikely to happen in the real world and B) we would not be able to provide any
useful information - invalid link or something would not help the user much...

[kuchhal, 2009-02-18 22:45:26]

I am not sure if this is the right way to fix ChromeHTML. We should really try
to fix the associations in the registry instead of doing this check. I am going
to CC couple more people to check what they think.

[ian fette, 2009-02-18 23:28:16]

I am fine with adding additional checks, but I think we fundamentally need to
fix the problem that we created bad registry entries. Those registry entries
need to be fixed.

[SkyLined, 2009-04-08 19:42:29]

http://codereview.chromium.org/21477 removes the feature to launch Chrome
through the "chromehtml:" protocol. So Chrome should never be launched with
"chromehtml:" in the arguments.

Rather than the current code terminating when "chromehtml:" is not preceded by
'--', should we not have code that terminates if it sees "chromehtml:" in the
arguments, regardless of the '--'?

[Sverrir, 2009-04-08 20:06:30]

The change I made was very conservative (when I started looking into this I was
trying not to break anything).  The benefit of this approach is that you at
least get an error message if you follow a chromehtml: link and since the change
removes the security threat of running chrome with arbitrary arguments I thought
it would be sufficient.

[SkyLined, 2009-04-08 20:41:24]

The problem is that we have yet another issue in "chromehtml:". If a user has an
"updated" registry entry that has the '--', this test is bypassed and an
attacker can exploit this issue.

As a mitigation to prevent any more issues, I'd preferably completely kill off
"chromehtml:". There is no legitimate use AFAIK but I will email the team to
make sure we can break this functionality.

[SkyLined, 2009-04-08 20:51:35]

Sorry, i should not have started this thread here, can we please move it to
http://code.google.com/p/chromium/issues/detail?id=9862 ? Thanks.