[DevTools] Whitelist remoteBase and loadNetworkResource schemes.

chrome/browser/devtools/devtools_ui_bindings.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/devtools/devtools_ui_bindings.h"
 
 #include <stddef.h>
 #include <utility>
 
 #include "base/json/json_reader.h"
@@ skipping 634 matching lines @@
   entry->SetTitle(
       base::UTF8ToUTF16(base::StringPrintf(kTitleFormat, url.c_str())));
   web_contents()->NotifyNavigationStateChanged(content::INVALIDATE_TYPE_TITLE);
 }
 
 void DevToolsUIBindings::LoadNetworkResource(const DispatchCallback& callback,
                                              const std::string& url,
                                              const std::string& headers,
                                              int stream_id) {
   GURL gurl(url);
-  if (!gurl.is_valid()) {
+  bool schemeIsAllowed = gurl.is_valid() &&
+      (gurl.SchemeIs(url::kHttpScheme) || gurl.SchemeIs(url::kHttpsScheme) ||
+       gurl.SchemeIs(url::kDataScheme) || gurl.SchemeIs(url::kFtpScheme));
+  if (!gurl.is_valid() || !schemeIsAllowed) {
     base::DictionaryValue response;
     response.SetInteger("statusCode", 404);
     callback.Run(&response);
     return;
   }
 
   net::URLFetcher* fetcher =
       net::URLFetcher::Create(gurl, net::URLFetcher::GET, this).release();
   pending_requests_[fetcher] = callback;
   fetcher->SetRequestContext(profile_->GetRequestContext());
@@ skipping 554 matching lines @@
     return;
   frontend_loaded_ = true;
 
   // Call delegate first - it seeds importants bit of information.
   delegate_->OnLoadCompleted();
 
   AddDevToolsExtensionsToClient();
   if (g_web_socket_api_channel)
     g_web_socket_api_channel->AttachedToBindings(this);
 }