Trim whitespace and check for unsafe scheme before adding a url in context me...

chrome/browser/tab_contents/render_view_context_menu.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <functional>
 
 #include "chrome/browser/tab_contents/render_view_context_menu.h"
 
 #include "app/clipboard/clipboard.h"
 #include "app/clipboard/scoped_clipboard_writer.h"
 #include "app/l10n_util.h"
 #include "base/command_line.h"
 #include "base/logging.h"
+#include "base/string_util.h"
 #include "chrome/app/chrome_dll_resource.h"
 #include "chrome/browser/autocomplete/autocomplete_classifier.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/child_process_security_policy.h"
 #include "chrome/browser/debugger/devtools_manager.h"
 #include "chrome/browser/debugger/devtools_window.h"
 #include "chrome/browser/download/download_manager.h"
 #include "chrome/browser/extensions/extension_menu_manager.h"
 #include "chrome/browser/extensions/extensions_service.h"
 #include "chrome/browser/fonts_languages_window.h"
 #include "chrome/browser/metrics/user_metrics.h"
 #include "chrome/browser/net/browser_url_util.h"
 #include "chrome/browser/page_info_window.h"
 #include "chrome/browser/pref_service.h"
@@ skipping 405 matching lines @@
   AppendMenuItem(IDS_CONTENT_CONTEXT_VIEWFRAMEINFO);
 }
 
 void RenderViewContextMenu::AppendCopyItem() {
   AppendMenuItem(IDS_CONTENT_CONTEXT_COPY);
 }
 
 void RenderViewContextMenu::AppendSearchProvider() {
   DCHECK(profile_);
 
+  TrimWhitespace(params_.selection_text, TRIM_ALL, &params_.selection_text);
+

[Peter Kasting, 2010/04/20 18:25:32]

Nit: You could probably remove this blank line.

   if (params_.selection_text.empty())
     return;
 
   AutocompleteMatch match;
   profile_->GetAutocompleteClassifier()->Classify(params_.selection_text,
                                                   std::wstring(), &match, NULL);
   selection_navigation_url_ = match.destination_url;
   if (!selection_navigation_url_.is_valid())
     return;
 
   string16 printable_selection_text = PrintableSelectionText();
   // Escape "&" as "&&".
   for (size_t i = printable_selection_text.find('&'); i != string16::npos;
        i = printable_selection_text.find('&', i + 2))
     printable_selection_text.insert(i, 1, '&');
 
   if (match.transition == PageTransition::TYPED) {
-    AppendMenuItem(IDS_CONTENT_CONTEXT_GOTOURL,
-                   l10n_util::GetStringFUTF16(IDS_CONTENT_CONTEXT_GOTOURL,
-                                              printable_selection_text));
+    if (ChildProcessSecurityPolicy::GetInstance()->IsWebSafeScheme(
+        selection_navigation_url_.scheme())) {
+      AppendMenuItem(IDS_CONTENT_CONTEXT_GOTOURL,
+                     l10n_util::GetStringFUTF16(IDS_CONTENT_CONTEXT_GOTOURL,
+                                                printable_selection_text));
+    }
   } else {
     const TemplateURL* const default_provider =
         profile_->GetTemplateURLModel()->GetDefaultSearchProvider();
     if (!default_provider)
       return;
     AppendMenuItem(IDS_CONTENT_CONTEXT_SEARCHWEBFOR,
                    l10n_util::GetStringFUTF16(IDS_CONTENT_CONTEXT_SEARCHWEBFOR,
                        WideToUTF16(default_provider->short_name()),
                        printable_selection_text));
   }
@@ skipping 813 matching lines @@
       profile_->GetPrefs()->GetString(prefs::kAcceptLanguages),
       g_browser_process->clipboard());
 }
 
 void RenderViewContextMenu::MediaPlayerActionAt(
     const gfx::Point& location,
     const WebMediaPlayerAction& action) {
   source_tab_contents_->render_view_host()->MediaPlayerActionAt(
       location, action);
 }