Validates links which are to be passed on to the NTP by ensuring that they st...

Validates links which are to be passed on to the NTP by ensuring that they start with "http://" or "https://".

BUG= http://crbug.com/15457
TEST= Change cached tip link in preferences file to be invalid.  Note that this tip will not be included on the NTP.


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=19415

[Miranda Callahan, 2009-06-26 17:31:44]

This patch reflects the results of the review meeting I had yesterday with Chris
Evans; he suggested this addition to ensure no bad stuff can be inserted into
the link text.

[arv (Not doing code reviews), 2009-06-26 18:21:57]

http://codereview.chromium.org/149083/diff/1/2
File chrome/browser/dom_ui/tips_handler.cc (right):

http://codereview.chromium.org/149083/diff/1/2#newcode84
Line 84: return (url_string.find(L"http://") == 0 ||
Don't you want to use something like:

GURL url(url_string);
return !url.spec().empty() && (url.SchemeIs("http") || url.schemIs("https"));

In this way we will not get tricked by some weird encoding etc.

http://codereview.chromium.org/149083/diff/1/3
File chrome/browser/dom_ui/tips_handler.h (right):

http://codereview.chromium.org/149083/diff/1/3#newcode42
Line 42: // Make sure string we are pushing to NTP as link is valid url.
Make sure the string we are pushing to the NTP is a valid URL.

[Miranda Callahan, 2009-06-26 19:25:13]

Thanks for the quick review; please take another look.

http://codereview.chromium.org/149083/diff/1/2
File chrome/browser/dom_ui/tips_handler.cc (right):

http://codereview.chromium.org/149083/diff/1/2#newcode84
Line 84: return (url_string.find(L"http://") == 0 ||
On 2009/06/26 18:21:58, arv wrote:
> Don't you want to use something like:
> 
> GURL url(url_string);
> return !url.spec().empty() && (url.SchemeIs("http") || url.schemIs("https"));
> 
> In this way we will not get tricked by some weird encoding etc.

Done.

http://codereview.chromium.org/149083/diff/1/3
File chrome/browser/dom_ui/tips_handler.h (right):

http://codereview.chromium.org/149083/diff/1/3#newcode42
Line 42: // Make sure string we are pushing to NTP as link is valid url.
On 2009/06/26 18:21:58, arv wrote:
> Make sure the string we are pushing to the NTP is a valid URL.

Done.

[arv (Not doing code reviews), 2009-06-26 19:38:03]

The linux failure is valid. Once that one is working feel free to submit.

[Miranda Callahan, 2009-06-26 20:13:20]

On 2009/06/26 19:38:03, arv wrote:
> The linux failure is valid. Once that one is working feel free to submit.

Fixed linux and mac compile failures; committing when trybot tests have passed.