| Index: content/browser/renderer_host/render_view_host.cc
|
| diff --git a/content/browser/renderer_host/render_view_host.cc b/content/browser/renderer_host/render_view_host.cc
|
| index 431d87bab21384535676052a5b8914de2f494868..c797151e5a0e2bfa2c4c4cc55849a80931708c1f 100644
|
| --- a/content/browser/renderer_host/render_view_host.cc
|
| +++ b/content/browser/renderer_host/render_view_host.cc
|
| @@ -1371,14 +1371,12 @@ void RenderViewHost::OnRequestDesktopNotificationPermission(
|
|
|
| void RenderViewHost::OnShowDesktopNotification(
|
| const DesktopNotificationHostMsg_Show_Params& params) {
|
| - // Disallow HTML notifications from unwanted schemes. javascript:
|
| - // in particular allows unwanted cross-domain access.
|
| + // Disallow HTML notifications from javascript: and file: schemes as this
|
| + // allows unwanted cross-domain access.
|
| GURL url = params.contents_url;
|
| if (params.is_html &&
|
| - !url.SchemeIs(chrome::kHttpScheme) &&
|
| - !url.SchemeIs(chrome::kHttpsScheme) &&
|
| - !url.SchemeIs(chrome::kExtensionScheme) &&
|
| - !url.SchemeIs(chrome::kDataScheme)) {
|
| + (url.SchemeIs(chrome::kJavaScriptScheme) ||
|
| + url.SchemeIs(chrome::kFileScheme))) {
|
| return;
|
| }
|
|
|
|
|