Prevent webview tags from navigating outside web-safe schemes.

content/browser/browser_plugin/browser_plugin_embedder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browser_plugin/browser_plugin_embedder.h"
 
 #include <set>
 
 #include "base/logging.h"
 #include "base/stl_util.h"
@@ skipping 121 matching lines @@
   GURL url(src);
   WebContentsImpl* guest_web_contents =
       static_cast<WebContentsImpl*>(guest->GetWebContents());
 
   // We do not load empty urls in web_contents.
   // If a guest sets empty src attribute after it has navigated to some
   // non-empty page, the action is considered no-op. This empty src navigation
   // should never be sent to BrowserPluginEmbedder (browser process).
   DCHECK(!src.empty());
   if (!src.empty()) {
-    // TODO(creis): Check the validity of the URL: http://crbug.com/139397.
+    // Because guests do not swap processes on navigation, only navigations to
+    // normal web URLs are supported.  No protocol handlers are installed for
+    // other schemes (e.g., WebUI or extensions), and no permissions or bindings
+    // can be granted to the guest process.
     guest_web_contents->GetController().LoadURL(url,
                                                 Referrer(),
                                                 PAGE_TRANSITION_AUTO_TOPLEVEL,
                                                 std::string());
   }
 
   // Resize the guest if the resize parameter was set from the renderer.
   ResizeGuest(render_view_host, instance_id, resize_params);
 }
 
@@ skipping 173 matching lines @@
       bool visible = *Details<bool>(details).ptr();
       WebContentsVisibilityChanged(visible);
       break;
     }
     default:
       NOTREACHED() << "Unexpected notification type: " << type;
   }
 }
 
 }  // namespace content