Make sure that extensions can launch web urls with web safe schemes only.

chrome/common/extensions/extension.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/extension.h"
 
 #include <algorithm>
 
 #include "base/base64.h"
 #include "base/basictypes.h"
@@ skipping 1260 matching lines @@
     }
 
     launch_local_path_ = launch_path;
   } else if (manifest->Get(keys::kLaunchWebURL, &temp)) {
     std::string launch_url;
     if (!temp->GetAsString(&launch_url)) {
       *error = errors::kInvalidLaunchWebURL;
       return false;
     }
 
-    // Ensure the launch URL is a valid absolute URL.
-    if (!GURL(launch_url).is_valid()) {
+    // Ensure the launch URL is a valid absolute URL and web extent scheme.
+    GURL url(launch_url);
+    URLPattern pattern(kValidWebExtentSchemes);
+    if (!url.is_valid() || !pattern.SetScheme(url.scheme())) {
       *error = errors::kInvalidLaunchWebURL;
       return false;
     }
 
     launch_web_url_ = launch_url;
   } else if (is_app()) {
     *error = errors::kLaunchURLRequired;
     return false;
   }
 
@@ skipping 1633 matching lines @@
 
 UninstalledExtensionInfo::~UninstalledExtensionInfo() {}
 
 
 UnloadedExtensionInfo::UnloadedExtensionInfo(
     const Extension* extension,
     Reason reason)
   : reason(reason),
     already_disabled(false),
     extension(extension) {}