Prevent webview tags from navigating outside web-safe schemes.

content/public/browser/render_view_host.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_BROWSER_RENDER_VIEW_HOST_H_
 #define CONTENT_PUBLIC_BROWSER_RENDER_VIEW_HOST_H_
 
 #include "base/values.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/render_widget_host.h"
@@ skipping 19 matching lines @@
 
 namespace WebKit {
 struct WebFindOptions;
 struct WebMediaPlayerAction;
 struct WebPluginAction;
 }
 
 namespace content {
 
 class ChildProcessSecurityPolicy;
 class RenderViewHostDelegate;

[joth, 2012/10/29 19:36:46]

nit: may as well add RenderProcessHost here. I think you're currently getting it
for free from one of the includes.

[Charlie Reis, 2012/10/29 19:41:42]

Done.

 class SessionStorageNamespace;
 class SiteInstance;
 struct CustomContextMenuContext;
 
 // A RenderViewHost is responsible for creating and talking to a RenderView
 // object in a child process. It exposes a high level API to users, for things
 // like loading pages, adjusting the display and other browser functionality,
 // which it translates into IPC messages sent over the IPC channel with the
 // RenderView. It responds to all IPC messages sent by that RenderView and
 // cracks them, calling a delegate object back with higher level types where
 // possible.
 //
 // The intent of this interface is to provide a view-agnostic communication
 // conduit with a renderer. This is so we can build HTML views not only as
 // WebContents (see WebContents for an example) but also as views, etc.
 class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
  public:
   // Returns the RenderViewHost given its ID and the ID of its render process.
   // Returns NULL if the IDs do not correspond to a live RenderViewHost.
   static RenderViewHost* FromID(int render_process_id, int render_view_id);
 
   // Downcasts from a RenderWidgetHost to a RenderViewHost.  Required
   // because RenderWidgetHost is a virtual base class.
   static RenderViewHost* From(RenderWidgetHost* rwh);
 
   // Checks that the given renderer can request |url|, if not it sets it to
   // about:blank.
   // |empty_allowed| must be set to false for navigations for security reasons.
-  static void FilterURL(int renderer_id,
+  static void FilterURL(const RenderProcessHost* process,
                         bool empty_allowed,
                         GURL* url);
 
   virtual ~RenderViewHost() {}
 
   // Tell the render view to enable a set of javascript bindings. The argument
   // should be a combination of values from BindingsPolicy.
   virtual void AllowBindings(int binding_flags) = 0;
 
   // Tells the renderer to clear the focused node (if any).
@@ skipping 204 matching lines @@
                                const WebKit::WebFindOptions& options,
                                int* match_count,
                                int* active_ordinal) = 0;
 #endif
 
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_RENDER_VIEW_HOST_H_