Prevent webview tags from navigating outside web-safe schemes.

chrome/browser/profiles/profile_impl_io_data.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/profiles/profile_impl_io_data.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/file_util.h"
 #include "base/logging.h"
@@ skipping 538 matching lines @@
     cookie_store = new net::CookieMonster(cookie_db.get(), NULL);
   }
 
   // Transfer ownership of the cookies and cache to AppRequestContext.
   context->SetCookieStore(cookie_store);
   context->SetHttpTransactionFactory(
       scoped_ptr<net::HttpTransactionFactory>(app_http_cache));
 
   // Overwrite the job factory that we inherit from the main context so
   // that we can later provide our own handles for storage related protocols.
+  // Install all the usual protocol handlers unless we are in a browser plugin
+  // guest process, in which case only web-safe schemes are allowed.
   scoped_ptr<net::URLRequestJobFactoryImpl> job_factory(
       new net::URLRequestJobFactoryImpl());
-  SetUpJobFactory(job_factory.get(), protocol_handler_interceptor.Pass(),
-                  network_delegate(),
-                  context->ftp_transaction_factory(),
-                  context->ftp_auth_cache());
+  if (!is_guest_process) {
+    SetUpJobFactory(job_factory.get(), protocol_handler_interceptor.Pass(),
+                    network_delegate(),
+                    context->ftp_transaction_factory(),
+                    context->ftp_auth_cache());
+  }
   context->SetJobFactory(job_factory.PassAs<net::URLRequestJobFactory>());
 
   return context;
 }
 
 ChromeURLRequestContext*
 ProfileImplIOData::InitializeMediaRequestContext(
     ChromeURLRequestContext* original_context,
     const std::string& app_id) const {
   // If this is for a guest process, we do not persist storage, so we can
@@ skipping 96 matching lines @@
 void ProfileImplIOData::ClearNetworkingHistorySinceOnIOThread(
     base::Time time) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   LazyInitialize();
 
   DCHECK(transport_security_state());
   transport_security_state()->DeleteSince(time);
   DCHECK(http_server_properties_manager());
   http_server_properties_manager()->Clear();
 }