Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(28)

Unified Diff: content/browser/browser_plugin/browser_plugin_embedder.cc

Issue 11313018: Prevent webview tags from navigating outside web-safe schemes. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Fix nit Created 8 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: content/browser/browser_plugin/browser_plugin_embedder.cc
diff --git a/content/browser/browser_plugin/browser_plugin_embedder.cc b/content/browser/browser_plugin/browser_plugin_embedder.cc
index c7992224ec8d6701ae5e469d9762ac525b100c76..d1ba266c4975e972064e2a324bcf21a35fc8f452 100644
--- a/content/browser/browser_plugin/browser_plugin_embedder.cc
+++ b/content/browser/browser_plugin/browser_plugin_embedder.cc
@@ -139,7 +139,10 @@ void BrowserPluginEmbedder::NavigateGuest(
// should never be sent to BrowserPluginEmbedder (browser process).
DCHECK(!src.empty());
if (!src.empty()) {
- // TODO(creis): Check the validity of the URL: http://crbug.com/139397.
+ // Because guests do not swap processes on navigation, only navigations to
+ // normal web URLs are supported. No protocol handlers are installed for
+ // other schemes (e.g., WebUI or extensions), and no permissions or bindings
+ // can be granted to the guest process.
guest_web_contents->GetController().LoadURL(url,
Referrer(),
PAGE_TRANSITION_AUTO_TOPLEVEL,
« no previous file with comments | « chrome/browser/profiles/profile_impl_io_data.cc ('k') | content/browser/browser_plugin/browser_plugin_host_browsertest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698