Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(232)

Issue 1669723002: NTP: don't allow navigateContentWindow to navigate where it pleases. (Closed)

Created:
4 years, 10 months ago by dcheng
Modified:
4 years, 10 months ago
CC:
chromium-apps-reviews_chromium.org, chromium-reviews, David Black, dhollowa+watch_chromium.org, donnd+watch_chromium.org, dougw+watch_chromium.org, extensions-reviews_chromium.org, jfweitz+watch_chromium.org, kmadhusu, melevin+watch_chromium.org, nasko, samarth, skanuj+watch_chromium.org
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

NTP: don't allow navigateContentWindow to navigate where it pleases. BUG=509313 Committed: https://crrev.com/d523a41aed4e321d4c8197b5cccb73be23c8dcc2 Cr-Commit-Position: refs/heads/master@{#373598}

Patch Set 1 #

Patch Set 2 : Check in browser ^_^ #

Patch Set 3 : Move all checks into InstantService. #

Patch Set 4 : Some tests #

Patch Set 5 : Add a null check #

Patch Set 6 : Add missing _ #

Total comments: 2

Patch Set 7 : Use constants for schemes. #

Patch Set 8 : Let it navigate more places it pleases. #

Patch Set 9 : -IWYU #

Total comments: 8

Patch Set 10 : Comments #

Total comments: 2

Patch Set 11 : Better comments #

Unified diffs Side-by-side diffs Delta from patch set Stats (+92 lines, -1 line) Patch
M chrome/browser/search/instant_service.h View 1 1 chunk +4 lines, -0 lines 0 comments Download
M chrome/browser/search/instant_service.cc View 1 2 3 4 5 6 7 8 2 chunks +26 lines, -0 lines 0 comments Download
M chrome/browser/search/instant_service_unittest.cc View 1 2 3 4 5 6 7 2 chunks +50 lines, -0 lines 0 comments Download
M chrome/browser/ui/search/search_tab_helper.cc View 1 2 3 4 5 6 7 8 9 10 1 chunk +9 lines, -0 lines 0 comments Download
M chrome/renderer/searchbox/searchbox_extension.cc View 1 2 3 4 5 6 7 8 9 1 chunk +3 lines, -1 line 0 comments Download

Messages

Total messages: 54 (17 generated)
dcheng
+jochen for primary review. The owners of this code appear to be inactive in Chromium, ...
4 years, 10 months ago (2016-02-04 02:52:40 UTC) #2
commit-bot: I haz the power
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1669723002/80001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1669723002/80001
4 years, 10 months ago (2016-02-04 04:36:13 UTC) #4
commit-bot: I haz the power
Dry run: Try jobs failed on following builders: linux_chromium_chromeos_rel_ng on tryserver.chromium.linux (JOB_FAILED, http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_chromeos_rel_ng/builds/161867)
4 years, 10 months ago (2016-02-04 04:49:45 UTC) #6
commit-bot: I haz the power
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1669723002/100001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1669723002/100001
4 years, 10 months ago (2016-02-04 04:58:42 UTC) #8
commit-bot: I haz the power
Dry run: This issue passed the CQ dry run.
4 years, 10 months ago (2016-02-04 06:12:00 UTC) #10
Marc Treib
LGTM (but I don't own anything here :-/) https://codereview.chromium.org/1669723002/diff/100001/chrome/browser/search/instant_service.cc File chrome/browser/search/instant_service.cc (right): https://codereview.chromium.org/1669723002/diff/100001/chrome/browser/search/instant_service.cc#newcode307 chrome/browser/search/instant_service.cc:307: if ...
4 years, 10 months ago (2016-02-04 14:00:14 UTC) #12
Pam (message me for reviews)
On 2016/02/04 14:00:14, Marc Treib wrote: > LGTM (but I don't own anything here :-/) ...
4 years, 10 months ago (2016-02-04 15:56:19 UTC) #13
dcheng
+thakis for OWNERS review +creis, +nasko as navigation experts I was looking at the scheme ...
4 years, 10 months ago (2016-02-04 16:21:01 UTC) #15
commit-bot: I haz the power
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1669723002/120001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1669723002/120001
4 years, 10 months ago (2016-02-04 16:21:34 UTC) #17
Robert Sesek
On 2016/02/04 16:21:01, dcheng wrote: > I was looking at the scheme blacklist, and I'm ...
4 years, 10 months ago (2016-02-04 16:35:15 UTC) #18
Jered
+mathp will this break most likely? Given the immediate concerns this lgtm.
4 years, 10 months ago (2016-02-04 17:05:55 UTC) #20
Mathieu
On 2016/02/04 17:05:55, Jered wrote: > +mathp will this break most likely? > > Given ...
4 years, 10 months ago (2016-02-04 17:11:26 UTC) #21
commit-bot: I haz the power
Dry run: This issue passed the CQ dry run.
4 years, 10 months ago (2016-02-04 17:12:11 UTC) #23
Charlie Reis
On 2016/02/04 16:35:15, Robert Sesek wrote: > On 2016/02/04 16:21:01, dcheng wrote: > > I ...
4 years, 10 months ago (2016-02-04 17:13:32 UTC) #24
Robert Sesek
On 2016/02/04 17:13:32, Charlie Reis wrote: > On 2016/02/04 16:35:15, Robert Sesek wrote: > > ...
4 years, 10 months ago (2016-02-04 17:17:46 UTC) #25
Charlie Reis
On 2016/02/04 17:13:32, Charlie Reis wrote: > On 2016/02/04 16:35:15, Robert Sesek wrote: > > ...
4 years, 10 months ago (2016-02-04 17:18:15 UTC) #26
samarth
We could also make this check in the renderer process in searchbox_extension here: https://code.google.com/p/chromium/codesearch#chromium/src/chrome/renderer/searchbox/searchbox_extension.cc&q=searchbox_exte&sq=package:chromium&l=1138 Note ...
4 years, 10 months ago (2016-02-04 17:20:44 UTC) #28
Charlie Reis
On 2016/02/04 17:20:44, samarth wrote: > We could also make this check in the renderer ...
4 years, 10 months ago (2016-02-04 17:26:25 UTC) #29
samarth
On 2016/02/04 17:26:25, Charlie Reis wrote: > On 2016/02/04 17:20:44, samarth wrote: > > We ...
4 years, 10 months ago (2016-02-04 17:43:46 UTC) #30
dcheng
On 2016/02/04 at 17:11:26, mathp wrote: > On 2016/02/04 17:05:55, Jered wrote: > > +mathp ...
4 years, 10 months ago (2016-02-04 17:48:58 UTC) #31
Charlie Reis
On 2016/02/04 17:43:46, samarth wrote: > On 2016/02/04 17:26:25, Charlie Reis wrote: > > On ...
4 years, 10 months ago (2016-02-04 17:51:07 UTC) #32
Jered
On 2016/02/04 17:43:46, samarth wrote: > On 2016/02/04 17:26:25, Charlie Reis wrote: > > On ...
4 years, 10 months ago (2016-02-04 17:51:21 UTC) #33
Jered
On 2016/02/04 17:51:07, Charlie Reis wrote: > On 2016/02/04 17:43:46, samarth wrote: > > On ...
4 years, 10 months ago (2016-02-04 17:53:20 UTC) #34
Charlie Reis
On 2016/02/04 17:48:58, dcheng wrote: > Breaking Chrome in a security merge is definitely something ...
4 years, 10 months ago (2016-02-04 17:53:40 UTC) #35
dcheng
On 2016/02/04 at 17:53:40, creis wrote: > On 2016/02/04 17:48:58, dcheng wrote: > > Breaking ...
4 years, 10 months ago (2016-02-04 17:56:44 UTC) #36
Charlie Reis
On 2016/02/04 17:53:20, Jered wrote: > > Fantastic. Thank for all the context. That makes ...
4 years, 10 months ago (2016-02-04 17:58:18 UTC) #37
finkm
On 2016/02/04 17:11:26, Mathieu Perreault wrote: > On 2016/02/04 17:05:55, Jered wrote: > > +mathp ...
4 years, 10 months ago (2016-02-04 18:12:25 UTC) #38
dcheng
PTAL, I've relaxed the check to just forbid chrome:// URLs. I've also added TODOs for ...
4 years, 10 months ago (2016-02-04 18:14:08 UTC) #39
Charlie Reis
LGTM with nits. https://codereview.chromium.org/1669723002/diff/160001/chrome/browser/ui/search/search_tab_helper.cc File chrome/browser/ui/search/search_tab_helper.cc (right): https://codereview.chromium.org/1669723002/diff/160001/chrome/browser/ui/search/search_tab_helper.cc#newcode454 chrome/browser/ui/search/search_tab_helper.cc:454: // items list. Note that the ...
4 years, 10 months ago (2016-02-04 18:37:53 UTC) #40
dcheng
https://codereview.chromium.org/1669723002/diff/160001/chrome/browser/ui/search/search_tab_helper.cc File chrome/browser/ui/search/search_tab_helper.cc (right): https://codereview.chromium.org/1669723002/diff/160001/chrome/browser/ui/search/search_tab_helper.cc#newcode454 chrome/browser/ui/search/search_tab_helper.cc:454: // items list. Note that the |is_most_visited_item_url| is apparently ...
4 years, 10 months ago (2016-02-04 18:41:33 UTC) #41
Charlie Reis
Some suggestions below. https://codereview.chromium.org/1669723002/diff/160001/chrome/browser/ui/search/search_tab_helper.cc File chrome/browser/ui/search/search_tab_helper.cc (right): https://codereview.chromium.org/1669723002/diff/160001/chrome/browser/ui/search/search_tab_helper.cc#newcode454 chrome/browser/ui/search/search_tab_helper.cc:454: // items list. Note that the ...
4 years, 10 months ago (2016-02-04 18:45:23 UTC) #42
dcheng
https://codereview.chromium.org/1669723002/diff/160001/chrome/browser/ui/search/search_tab_helper.cc File chrome/browser/ui/search/search_tab_helper.cc (right): https://codereview.chromium.org/1669723002/diff/160001/chrome/browser/ui/search/search_tab_helper.cc#newcode454 chrome/browser/ui/search/search_tab_helper.cc:454: // items list. Note that the |is_most_visited_item_url| is apparently ...
4 years, 10 months ago (2016-02-04 19:05:01 UTC) #43
Charlie Reis
Thanks. LGTM. https://codereview.chromium.org/1669723002/diff/180001/chrome/browser/ui/search/search_tab_helper.cc File chrome/browser/ui/search/search_tab_helper.cc (right): https://codereview.chromium.org/1669723002/diff/180001/chrome/browser/ui/search/search_tab_helper.cc#newcode455 chrome/browser/ui/search/search_tab_helper.cc:455: // TODO(trieb) The |is_most_visited_item_url| is meaningless: the ...
4 years, 10 months ago (2016-02-04 19:10:04 UTC) #44
dcheng
https://codereview.chromium.org/1669723002/diff/180001/chrome/browser/ui/search/search_tab_helper.cc File chrome/browser/ui/search/search_tab_helper.cc (right): https://codereview.chromium.org/1669723002/diff/180001/chrome/browser/ui/search/search_tab_helper.cc#newcode455 chrome/browser/ui/search/search_tab_helper.cc:455: // TODO(trieb) The |is_most_visited_item_url| is meaningless: the way it's ...
4 years, 10 months ago (2016-02-04 19:12:39 UTC) #46
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1669723002/200001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1669723002/200001
4 years, 10 months ago (2016-02-04 19:13:25 UTC) #48
commit-bot: I haz the power
Committed patchset #11 (id:200001)
4 years, 10 months ago (2016-02-04 20:06:23 UTC) #52
commit-bot: I haz the power
4 years, 10 months ago (2016-02-04 20:07:36 UTC) #54
Message was sent while issue was closed.
Patchset 11 (id:??) landed as
https://crrev.com/d523a41aed4e321d4c8197b5cccb73be23c8dcc2
Cr-Commit-Position: refs/heads/master@{#373598}

Powered by Google App Engine
This is Rietveld 408576698