Validates links which are to be passed on to the NTP by ensuring that they st...

chrome/browser/dom_ui/tips_handler.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/string_util.h"
 #include "base/values.h"
 #include "chrome/browser/dom_ui/tips_handler.h"
 #include "chrome/browser/profile.h"
 #include "chrome/browser/web_resource/web_resource_service.h"
+#include "chrome/common/pref_names.h"
 #include "chrome/common/web_resource/web_resource_unpacker.h"
-#include "chrome/common/pref_names.h"
+#include "chrome/common/url_constants.h"
+#include "googleurl/src/gurl.h"
 
 namespace {
 
   const int kNumTipsToShow = 2;
 
   // TODO(mrc): l10n
   // This title should only appear the very first time Chrome is run with
   // web resources enabled; otherwise the cache should be populated.
   static const wchar_t* kTipsTitleAtStartup =
       L"Tips and recommendations to help you discover interesting websites.";
@@ skipping 31 matching lines @@
     DictionaryValue* tip_dict = new DictionaryValue();
     tip_dict->SetString(WebResourceService::kWebResourceTitle, title);
     list_value.Append(tip_dict);
   } else {
     int tip_counter = 0;
     while (tips_cache_->GetDictionary(IntToWString(tip_counter++), &wr_dict)) {
       DictionaryValue* tip_dict = new DictionaryValue();
       if (wr_dict &&
           wr_dict->GetSize() > 0 &&
           wr_dict->GetString(WebResourceService::kWebResourceTitle, &title) &&
-          wr_dict->GetString(WebResourceService::kWebResourceURL, &url)) {
+          wr_dict->GetString(WebResourceService::kWebResourceURL, &url) &&
+          IsValidURL(url)) {
         tip_dict->SetString(WebResourceService::kWebResourceTitle, title);
         tip_dict->SetString(WebResourceService::kWebResourceURL, url);
         list_value.Append(tip_dict);
       }
     }
   }
 
   // Send list of web resource items back out to the DOM.
   dom_ui_->CallJavascriptFunction(L"tips", list_value);
 }
 
 // static
 void TipsHandler::RegisterUserPrefs(PrefService* prefs) {
   prefs->RegisterDictionaryPref(prefs::kNTPTipsCache);
   prefs->RegisterStringPref(prefs::kNTPTipsServer,
                             WebResourceService::kDefaultResourceServer);
 }
 
+bool TipsHandler::IsValidURL(const std::wstring& url_string) {
+  GURL url(WideToUTF8(url_string));
+  return !url.is_empty() && (url.SchemeIs(chrome::kHttpScheme) ||
+                             url.SchemeIs(chrome::kHttpsScheme));
+}