Prevent registerProtocolHandler for pseudo-schemes and disabled schemes.

chrome/browser/ui/tab_contents/tab_contents_wrapper.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/tab_contents/tab_contents_wrapper.h"
 
 #include "base/command_line.h"
 #include "base/lazy_instance.h"
 #include "chrome/browser/autocomplete_history_manager.h"
 #include "chrome/browser/autofill/autofill_manager.h"
@@ skipping 27 matching lines @@
 #include "chrome/browser/translate/translate_tab_helper.h"
 #include "chrome/browser/ui/blocked_content/blocked_content_tab_helper.h"
 #include "chrome/browser/ui/bookmarks/bookmark_tab_helper.h"
 #include "chrome/browser/ui/download/download_tab_helper.h"
 #include "chrome/browser/ui/find_bar/find_tab_helper.h"
 #include "chrome/browser/ui/search_engines/search_engine_tab_helper.h"
 #include "chrome/browser/ui/tab_contents/tab_contents_wrapper_delegate.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/render_messages.h"
+#include "content/browser/child_process_security_policy.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/tab_contents/tab_contents.h"
 #include "content/common/notification_service.h"
 #include "content/common/view_messages.h"
 #include "grit/generated_resources.h"
 #include "grit/locale_settings.h"
 #include "grit/platform_locale_settings.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "webkit/glue/webpreferences.h"
 
@@ skipping 438 matching lines @@
 // Internal helpers
 
 void TabContentsWrapper::OnJSOutOfMemory() {
   AddInfoBar(new SimpleAlertInfoBarDelegate(tab_contents(),
       NULL, l10n_util::GetStringUTF16(IDS_JS_OUT_OF_MEMORY_PROMPT), true));
 }
 
 void TabContentsWrapper::OnRegisterProtocolHandler(const std::string& protocol,
                                                    const GURL& url,
                                                    const string16& title) {
+  ChildProcessSecurityPolicy* policy =
+      ChildProcessSecurityPolicy::GetInstance();
+  if (policy->IsPseudoScheme(protocol) || policy->IsDisabledScheme(protocol))
+    return;
+
   ProtocolHandlerRegistry* registry = profile()->GetProtocolHandlerRegistry();
-  if (!registry->enabled()) {
+  if (!registry->enabled())
     return;
-  }
+
   ProtocolHandler handler =
       ProtocolHandler::CreateProtocolHandler(protocol, url, title);
   if (!handler.IsEmpty() &&
       registry->CanSchemeBeOverridden(handler.protocol())) {
     AddInfoBar(registry->IsRegistered(handler) ?
         static_cast<InfoBarDelegate*>(new SimpleAlertInfoBarDelegate(
             tab_contents(), NULL, l10n_util::GetStringFUTF16(
                 IDS_REGISTER_PROTOCOL_HANDLER_ALREADY_REGISTERED,
                 handler.title(), UTF8ToUTF16(handler.protocol())), true)) :
       new RegisterProtocolHandlerInfoBarDelegate(tab_contents(), registry,
@@ skipping 35 matching lines @@
 void TabContentsWrapper::UpdateWebPreferences() {
   RenderViewHostDelegate* rvhd = tab_contents();
   Send(new ViewMsg_UpdateWebPreferences(routing_id(), rvhd->GetWebkitPrefs()));
 }
 
 void TabContentsWrapper::UpdateRendererPreferences() {
   renderer_preferences_util::UpdateFromSystemSettings(
       tab_contents()->GetMutableRendererPrefs(), profile());
   render_view_host()->SyncRendererPrefs();
 }