Remove URL fragment from referrer HTTP header when opening link using "Open Link in New Tab" option.

chrome/browser/tab_contents/render_view_context_menu.cc

Index: chrome/browser/tab_contents/render_view_context_menu.cc
diff --git a/chrome/browser/tab_contents/render_view_context_menu.cc b/chrome/browser/tab_contents/render_view_context_menu.cc
index 8cb23b524a7e5fe895810a480f0c385e9981ae33..76a7caef716fa35ad6c89d12ebeb91875524b4db 100644
--- a/chrome/browser/tab_contents/render_view_context_menu.cc
+++ b/chrome/browser/tab_contents/render_view_context_menu.cc
@@ -1849,9 +1849,21 @@ void RenderViewContextMenu::OpenURL(
     const GURL& url, const GURL& referrer, int64 frame_id,
     WindowOpenDisposition disposition,
     content::PageTransition transition) {
+  // Ensure that URL fragment, username and password fields are not sent
+  // in the referrer.
+  GURL sanitized_referrer(referrer);
+  if (sanitized_referrer.is_valid() && (sanitized_referrer.has_ref() ||
+      sanitized_referrer.has_username() || sanitized_referrer.has_password())) {
+    GURL::Replacements referrer_mods;
+    referrer_mods.ClearRef();
+    referrer_mods.ClearUsername();
+    referrer_mods.ClearPassword();
+    sanitized_referrer = sanitized_referrer.ReplaceComponents(referrer_mods);
+  }
+
   WebContents* new_contents = source_web_contents_->OpenURL(OpenURLParams(
-      url, content::Referrer(referrer, params_.referrer_policy), disposition,
-      transition, false));
+      url, content::Referrer(sanitized_referrer, params_.referrer_policy),
+      disposition, transition, false));
   if (!new_contents)
     return;