Prevent webview tags from navigating outside web-safe schemes.

content/browser/browser_plugin/browser_plugin_host_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/memory/singleton.h"
 #include "base/run_loop.h"
 #include "base/test/test_timeouts.h"
 #include "base/utf_string_conversions.h"
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
@@ skipping 725 matching lines @@
       StringPrintf("SetSrc('%s');", kHTMLForGuest)));
 
   string16 actual_title = title_watcher.WaitAndGetTitle();
   EXPECT_EQ(expected_title, actual_title);
 }
 
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, LoadAbort) {
   const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, "about:blank", true, "");
 
-  const string16 expected_title = ASCIIToUTF16("ERR_EMPTY_RESPONSE");
-  content::TitleWatcher title_watcher(test_embedder()->web_contents(),
-                                      expected_title);
+  {
+    // Navigate the guest to "close-socket".
+    const string16 expected_title = ASCIIToUTF16("ERR_EMPTY_RESPONSE");
+    content::TitleWatcher title_watcher(test_embedder()->web_contents(),
+                                        expected_title);
+    RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
+        test_embedder()->web_contents()->GetRenderViewHost());
+    GURL test_url = test_server()->GetURL("close-socket");
+    ExecuteSyncJSFunction(rvh, ASCIIToUTF16(
+        StringPrintf("SetSrc('%s');", test_url.spec().c_str())));
+    string16 actual_title = title_watcher.WaitAndGetTitle();
+    EXPECT_EQ(expected_title, actual_title);
+  }
 
-  // Renavigate the guest to "close-socket".
-  RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
-      test_embedder()->web_contents()->GetRenderViewHost());
-  GURL test_url = test_server()->GetURL("close-socket");
-  ExecuteSyncJSFunction(rvh, ASCIIToUTF16(
-      StringPrintf("SetSrc('%s');", test_url.spec().c_str())));
+  {
+    // Navigate the guest to an illegal chrome:// URL.
+    const string16 expected_title = ASCIIToUTF16("ERR_FAILED");
+    content::TitleWatcher title_watcher(test_embedder()->web_contents(),
+                                        expected_title);
+    RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
+        test_embedder()->web_contents()->GetRenderViewHost());
+    GURL test_url("chrome://newtab");
+    ExecuteSyncJSFunction(rvh, ASCIIToUTF16(
+        StringPrintf("SetSrc('%s');", test_url.spec().c_str())));
+    string16 actual_title = title_watcher.WaitAndGetTitle();
+    EXPECT_EQ(expected_title, actual_title);
+  }
 
-  string16 actual_title = title_watcher.WaitAndGetTitle();
-  EXPECT_EQ(expected_title, actual_title);
+  {
+    // Navigate the guest to an illegal file:// URL.
+    const string16 expected_title = ASCIIToUTF16("ERR_ABORTED");
+    content::TitleWatcher title_watcher(test_embedder()->web_contents(),
+                                        expected_title);
+    RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
+        test_embedder()->web_contents()->GetRenderViewHost());
+    GURL test_url("file://foo");
+    ExecuteSyncJSFunction(rvh, ASCIIToUTF16(
+        StringPrintf("SetSrc('%s');", test_url.spec().c_str())));
+    string16 actual_title = title_watcher.WaitAndGetTitle();
+    EXPECT_EQ(expected_title, actual_title);
+  }
 }
 
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, LoadRedirect) {
   const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, "about:blank", true, "");
 
   const string16 expected_title = ASCIIToUTF16("redirected");
   content::TitleWatcher title_watcher(test_embedder()->web_contents(),
                                       expected_title);
 
@@ skipping 191 matching lines @@
   string16 actual_title = title_watcher.WaitAndGetTitle();
   EXPECT_EQ(expected_title, actual_title);
   scoped_ptr<base::Value> is_top_level(rvh->ExecuteJavascriptAndGetValue(
       string16(), ASCIIToUTF16("commitIsTopLevel")));
   bool top_level_bool = false;
   EXPECT_TRUE(is_top_level->GetAsBoolean(&top_level_bool));
   EXPECT_EQ(true, top_level_bool);
 }
 
 }  // namespace content