Also filter the URLs from incoming non-provisional navigation IPCs.

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 8fcb09c12c4947362c05f6e3f50025238096d4af..5efad8a709d262f31e698428b6a52a04f4394d6a 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -2135,8 +2135,11 @@ void WebContentsImpl::OnDocumentLoadedInFrame(int64 frame_id) {
 
 void WebContentsImpl::OnDidFinishLoad(
     int64 frame_id,
-    const GURL& validated_url,

[Charlie Reis, 2013/01/07 18:49:03]

Wow, why was that called validated?  It's coming straight from the renderer.  I
agree that it should go through FilterURL.

+    const GURL& url,
     bool is_main_frame) {
+  GURL validated_url(url);
+  RenderProcessHost* render_process_host = message_source_->GetProcess();
+  RenderViewHost::FilterURL(render_process_host, false, &validated_url);
   FOR_EACH_OBSERVER(WebContentsObserver, observers_,
                     DidFinishLoad(frame_id, validated_url, is_main_frame,
                                   message_source_));
@@ -2144,10 +2147,13 @@ void WebContentsImpl::OnDidFinishLoad(
 
 void WebContentsImpl::OnDidFailLoadWithError(
     int64 frame_id,
-    const GURL& validated_url,
+    const GURL& url,
     bool is_main_frame,
     int error_code,
     const string16& error_description) {
+  GURL validated_url(url);
+  RenderProcessHost* render_process_host = message_source_->GetProcess();
+  RenderViewHost::FilterURL(render_process_host, false, &validated_url);
   FOR_EACH_OBSERVER(WebContentsObserver, observers_,
                     DidFailLoad(frame_id, validated_url, is_main_frame,
                                 error_code, error_description,