Disable pushState and the rest of the history API in packaged apps via runtime-enabled features

chrome/renderer/chrome_render_view_observer.cc

Index: chrome/renderer/chrome_render_view_observer.cc
diff --git a/chrome/renderer/chrome_render_view_observer.cc b/chrome/renderer/chrome_render_view_observer.cc
index 3521944bf122cbaf93729e5d09bac85fdf90e980..d1653992dc1a993ef9f1c41fefbd6b28b094b6d6 100644
--- a/chrome/renderer/chrome_render_view_observer.cc
+++ b/chrome/renderer/chrome_render_view_observer.cc
@@ -529,6 +529,12 @@ bool ChromeRenderViewObserver::allowMutationEvents(const WebDocument& document,
   return default_value;
 }
 
+bool ChromeRenderViewObserver::allowPushState(const WebDocument& document) {
+  WebSecurityOrigin origin = document.securityOrigin();
+  const extensions::Extension* extension = GetExtension(origin);
+  return !extension || !extension->is_platform_app();
+}
+
 static void SendInsecureContentSignal(int signal) {
   UMA_HISTOGRAM_ENUMERATION("SSL.InsecureContent", signal,
                             INSECURE_CONTENT_NUM_EVENTS);