Prevent webview tags from navigating outside web-safe schemes.

chrome/browser/profiles/profile_impl_io_data.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/profiles/profile_impl_io_data.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/file_util.h"
 #include "base/logging.h"
@@ skipping 469 matching lines @@
 }
 
 ChromeURLRequestContext*
 ProfileImplIOData::InitializeAppRequestContext(
     ChromeURLRequestContext* main_context,
     const std::string& app_id,
     scoped_ptr<net::URLRequestJobFactory::Interceptor>
         protocol_handler_interceptor) const {
   // If this is for a guest process, we should not persist cookies and http
   // cache.
   bool is_guest_process = (app_id.find("guest-") != std::string::npos);

[Tom Sepez, 2012/10/29 17:59:08]

Not your problem, but is there a better way of finding this out? "guest-"
anywhere in the string? At the least, wouldn't it have to start with "guest-".

[Charlie Reis, 2012/10/29 18:18:31]

Funny you should mention it-- Albert and Nasko are just fixing that in
https://codereview.chromium.org/11308024/.  :)

 
   // Copy most state from the main context.
   AppRequestContext* context = new AppRequestContext(load_time_stats());
   context->CopyFrom(main_context);
 
   using content::StoragePartition;
   FilePath app_path =
       profile_path_.Append(StoragePartition::GetPartitionPath(app_id));
 
   FilePath cookie_path = app_path.Append(chrome::kCookieFilename);
@@ skipping 48 matching lines @@
     cookie_store = new net::CookieMonster(cookie_db.get(), NULL);
   }
 
   // Transfer ownership of the cookies and cache to AppRequestContext.
   context->SetCookieStore(cookie_store);
   context->SetHttpTransactionFactory(
       scoped_ptr<net::HttpTransactionFactory>(app_http_cache));
 
   // Overwrite the job factory that we inherit from the main context so
   // that we can later provide our own handles for storage related protocols.
+  // Install all the usual protocol handlers unless we are in a browser plugin
+  // guest process, in which case only web-safe schemes are allowed.
   scoped_ptr<net::URLRequestJobFactoryImpl> job_factory(
       new net::URLRequestJobFactoryImpl());
-  SetUpJobFactory(job_factory.get(), protocol_handler_interceptor.Pass(),
-                  network_delegate(),
-                  context->ftp_transaction_factory(),
-                  context->ftp_auth_cache());
+  if (!is_guest_process) {
+    SetUpJobFactory(job_factory.get(), protocol_handler_interceptor.Pass(),
+                    network_delegate(),
+                    context->ftp_transaction_factory(),
+                    context->ftp_auth_cache());
+  }
   context->SetJobFactory(job_factory.PassAs<net::URLRequestJobFactory>());
 
   return context;
 }
 
 ChromeURLRequestContext*
 ProfileImplIOData::InitializeMediaRequestContext(
     ChromeURLRequestContext* original_context,
     const std::string& app_id) const {
   // If this is for a guest process, we do not persist storage, so we can
@@ skipping 96 matching lines @@
 void ProfileImplIOData::ClearNetworkingHistorySinceOnIOThread(
     base::Time time) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   LazyInitialize();
 
   DCHECK(transport_security_state());
   transport_security_state()->DeleteSince(time);
   DCHECK(http_server_properties_manager());
   http_server_properties_manager()->Clear();
 }