Make sure that extensions can launch web urls, create bookmark url with web safe schemes only.

chrome/browser/extensions/extension_bookmarks_module.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_bookmarks_module.h"
 
 #include "base/file_path.h"
 #include "base/i18n/file_util_icu.h"
 #include "base/i18n/time_formatting.h"
 #include "base/json/json_writer.h"
@@ skipping 13 matching lines @@
 #include "chrome/browser/extensions/extension_bookmarks_module_constants.h"
 #include "chrome/browser/extensions/extension_event_router.h"
 #include "chrome/browser/extensions/extensions_quota_service.h"
 #include "chrome/browser/importer/importer_data_types.h"
 #include "chrome/browser/importer/importer_host.h"
 #include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/pref_names.h"
+#include "content/browser/child_process_security_policy.h"
 #include "content/common/notification_service.h"
 #include "grit/generated_resources.h"
 #include "ui/base/l10n/l10n_util.h"
 
 namespace keys = extension_bookmarks_module_constants;
 
 using base::TimeDelta;
 typedef QuotaLimitHeuristic::Bucket Bucket;
 typedef QuotaLimitHeuristic::Config Config;
 typedef QuotaLimitHeuristic::BucketList BucketList;
@@ skipping 417 matching lines @@
     if (index > parent->child_count() || index < 0) {
       error_ = keys::kInvalidIndexError;
       return false;
     }
   }
 
   string16 title;
   json->GetString(keys::kTitleKey, &title);  // Optional.
   std::string url_string;
   json->GetString(keys::kUrlKey, &url_string);  // Optional.
+
+  // Ensure the bookmark URL is a valid URL and has a web safe scheme.
   GURL url(url_string);
-  if (!url.is_empty() && !url.is_valid()) {
+  ChildProcessSecurityPolicy *policy =
+    ChildProcessSecurityPolicy::GetInstance();
+  if (!url.is_empty() &&
+      (!url.is_valid() || !policy->IsWebSafeScheme(url.scheme()))) {
     error_ = keys::kInvalidUrlError;
     return false;
   }
 
   const BookmarkNode* node;
   if (url_string.length())
     node = model->AddURL(parent, index, title, url);
   else
     node = model->AddFolder(parent, index, title);
   DCHECK(node);
@@ skipping 425 matching lines @@
   SelectFile(SelectFileDialog::SELECT_SAVEAS_FILE);
   return true;
 }
 
 void ExportBookmarksFunction::FileSelected(const FilePath& path,
                                            int index,
                                            void* params) {
   bookmark_html_writer::WriteBookmarks(profile(), path, NULL);
   Release();  // Balanced in BookmarksIOFunction::SelectFile()
 }