Allow huge data: URIs only via WebView.loadDataWithBaseUrl

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 17d8764e90f8b8d4f2b6049c8fbf9f7f0328b205..39fc46ff31817db2239561046a525c444e5abaa5 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -543,8 +543,8 @@ CommonNavigationParams MakeCommonNavigationParams(
   return CommonNavigationParams(
       request->url(), referrer, extra_data->transition_type(),
       FrameMsg_Navigate_Type::NORMAL, true, should_replace_current_entry,
-      ui_timestamp, report_type, GURL(), GURL(), LOFI_UNSPECIFIED,
-      base::TimeTicks::Now());
+      ui_timestamp, report_type, GURL(), GURL(), std::string(),
+      LOFI_UNSPECIFIED, base::TimeTicks::Now());
 }
 
 #if !defined(OS_ANDROID) || defined(ENABLE_MEDIA_PIPELINE_ON_ANDROID)
@@ -3382,7 +3382,7 @@ void RenderFrameImpl::showContextMenu(const blink::WebContextMenuData& data) {
   // in the context menu.
   // TODO(jcivelli): http://crbug.com/45160 This prevents us from saving large
   //                 data encoded images.  We should have a way to save them.
-  if (params.src_url.spec().size() > GetMaxURLChars())
+  if (params.src_url.spec().size() > kMaxURLChars)
     params.src_url = GURL();
   context_menu_node_ = data.node;
 
@@ -5142,7 +5142,10 @@ void RenderFrameImpl::LoadDataURL(const CommonNavigationParams& params,
                                   blink::WebFrameLoadType load_type) {
   // A loadData request with a specified base URL.
   std::string mime_type, charset, data;
-  if (net::DataURL::Parse(params.url, &mime_type, &charset, &data)) {
+  if (net::DataURL::Parse(params.data_url_as_string.empty()
+                              ? params.url
+                              : GURL(params.data_url_as_string),

[Charlie Reis, 2015/12/10 20:43:47]

This is the kind of check I'm concerned about, which will likely have bugs in
the future.  LoadDataURL is only called if params.url has a data scheme, but
there's nothing guaranteeing that params.data_url_as_string matches params.url
or has a data scheme.  Any other checks we did on params.url similarly won't
have applied to data_url_as_string.

[mnaganov (inactive), 2015/12/11 23:14:24]

Added more checks to ensure that the main url's data is empty, and that 
data_url_as_string is really a data url.

[Charlie Reis, 2015/12/14 20:35:56]

Acknowledged.

+                          &mime_type, &charset, &data)) {
     const GURL base_url = params.base_url_for_data_url.is_empty() ?
         params.url : params.base_url_for_data_url;
     bool replace = load_type == blink::WebFrameLoadType::ReloadFromOrigin ||