Allow huge data: URIs only via WebView.loadDataWithBaseUrl

content/browser/frame_host/navigation_controller_android.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_controller_android.h"
 
 #include "base/android/jni_android.h"
 #include "base/android/jni_array.h"
 #include "base/android/jni_string.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/ssl_host_state_delegate.h"
 #include "jni/NavigationControllerImpl_jni.h"
+#include "net/base/data_url.h"
 #include "ui/gfx/android/java_bitmap.h"
 
 using base::android::AttachCurrentThread;
 using base::android::ConvertJavaStringToUTF16;
 using base::android::ConvertJavaStringToUTF8;
 using base::android::ConvertUTF16ToJavaString;
 using base::android::ConvertUTF8ToJavaString;
 namespace {
 
 // static
@@ skipping 163 matching lines @@
     const JavaParamRef<jstring>& url,
     jint load_url_type,
     jint transition_type,
     const JavaParamRef<jstring>& j_referrer_url,
     jint referrer_policy,
     jint ua_override_option,
     const JavaParamRef<jstring>& extra_headers,
     const JavaParamRef<jbyteArray>& post_data,
     const JavaParamRef<jstring>& base_url_for_data_url,
     const JavaParamRef<jstring>& virtual_url_for_data_url,
+    const JavaParamRef<jstring>& data_url_as_string,
     jboolean can_load_local_resources,
     jboolean is_renderer_initiated,
     jboolean should_replace_current_entry) {
   DCHECK(url);
   NavigationController::LoadURLParams params(
       GURL(ConvertJavaStringToUTF8(env, url)));
 
   params.load_type =
       static_cast<NavigationController::LoadURLType>(load_url_type);
   params.transition_type = ui::PageTransitionFromInt(transition_type);
@@ skipping 17 matching lines @@
   if (base_url_for_data_url) {
     params.base_url_for_data_url =
         GURL(ConvertJavaStringToUTF8(env, base_url_for_data_url));
   }
 
   if (virtual_url_for_data_url) {
     params.virtual_url_for_data_url =
         GURL(ConvertJavaStringToUTF8(env, virtual_url_for_data_url));
   }
 
+  if (data_url_as_string) {
+    // Treat |data_url_as_string| as if we were intenting to put it into a GURL

[Charlie Reis, 2015/12/14 20:35:57]

nit: intending

[mnaganov (inactive), 2015/12/15 18:30:29]

Done.

+    // field. Note that kMaxURLChars is only enforced when serializing URLs
+    // for IPC.
+    GURL data_url = GURL(ConvertJavaStringToUTF8(env, data_url_as_string));
+    DCHECK(data_url.SchemeIs(url::kDataScheme));
+    DCHECK(params.url.SchemeIs(url::kDataScheme));
+#if DCHECK_IS_ON()
+    {
+      std::string mime_type, charset, data;
+      DCHECK(net::DataURL::Parse(params.url, &mime_type, &charset, &data));
+      DCHECK(data.empty());
+    }
+#endif
+    std::string s = data_url.spec();
+    params.data_url_as_string = base::RefCountedString::TakeString(&s);
+  }
+
   if (j_referrer_url) {
     params.referrer = content::Referrer(
         GURL(ConvertJavaStringToUTF8(env, j_referrer_url)),
         static_cast<blink::WebReferrerPolicy>(referrer_policy));
   }
 
   navigation_controller_->LoadURLWithParams(params);
 }
 
 void NavigationControllerAndroid::ClearHistory(
@@ skipping 154 matching lines @@
     const JavaParamRef<jobject>& obj,
     jlong source_navigation_controller_android,
     jboolean replace_entry) {
   navigation_controller_->CopyStateFromAndPrune(
       reinterpret_cast<NavigationControllerAndroid*>(
           source_navigation_controller_android)->navigation_controller_,
       replace_entry);
 }
 
 }  // namespace content