Restricting redirects to chrome:

content/browser/renderer_host/resource_dispatcher_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "content/browser/renderer_host/resource_dispatcher_host.h"
 
 #include <set>
 #include <vector>
@@ skipping 1171 matching lines @@
 void ResourceDispatcherHost::OnReceivedRedirect(net::URLRequest* request,
                                                 const GURL& new_url,
                                                 bool* defer_redirect) {
   VLOG(1) << "OnReceivedRedirect: " << request->url().spec();
   ResourceDispatcherHostRequestInfo* info = InfoForRequest(request);
 
   DCHECK(request->status().is_success());
 
   if (info->process_type() != ChildProcessInfo::PLUGIN_PROCESS &&
       !ChildProcessSecurityPolicy::GetInstance()->
-          CanRequestURL(info->child_id(), new_url)) {
+          CanRedirectURL(info->child_id(), new_url)) {
     VLOG(1) << "Denied unauthorized request for "
             << new_url.possibly_invalid_spec();
 
     // Tell the renderer that this request was disallowed.
     CancelRequestInternal(request, false);
     return;
   }
 
   NotifyReceivedRedirect(request, info->child_id(), new_url);
 
@@ skipping 929 matching lines @@
   return HTTP_AUTH_RESOURCE_BLOCKED_CROSS;
 }
 
 bool ResourceDispatcherHost::allow_cross_origin_auth_prompt() {
   return allow_cross_origin_auth_prompt_;
 }
 
 void ResourceDispatcherHost::set_allow_cross_origin_auth_prompt(bool value) {
   allow_cross_origin_auth_prompt_ = value;
 }