NTP: don't allow navigateContentWindow to navigate where it pleases.

chrome/browser/search/instant_service.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/search/instant_service.h"
 
 #include <stddef.h>
 
 #include "base/metrics/field_trial.h"
 #include "base/strings/string_util.h"
@@ skipping 24 matching lines @@
 #include "components/favicon/core/large_icon_service.h"
 #include "components/history/core/browser/top_sites.h"
 #include "components/keyed_service/core/service_access_type.h"
 #include "components/search/search.h"
 #include "components/search_engines/template_url_service.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/url_data_source.h"
+#include "content/public/common/url_constants.h"
 #include "grit/theme_resources.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/gfx/color_utils.h"
 #include "ui/gfx/image/image_skia.h"
+#include "url/url_constants.h"
 
 #if !defined(OS_ANDROID)
 #include "chrome/browser/search/local_ntp_source.h"
 #endif
 
 #if defined(ENABLE_THEMES)
 #include "chrome/browser/themes/theme_properties.h"
 #include "chrome/browser/themes/theme_service.h"
 #include "chrome/browser/themes/theme_service_factory.h"
 #endif  // defined(ENABLE_THEMES)
@@ skipping 234 matching lines @@
     default:
       NOTREACHED() << "Unexpected notification type in InstantService.";
   }
 }
 
 void InstantService::SendSearchURLsToRenderer(content::RenderProcessHost* rph) {
   rph->Send(new ChromeViewMsg_SetSearchURLs(
       search::GetSearchURLs(profile_), search::GetNewTabPageURL(profile_)));
 }
 
+bool InstantService::IsValidURLForNavigation(const GURL& url) const {
+  // Certain URLs are privileged and should never be considered valid
+  // navigation targets.
+  // TODO(treib): Ideally this should deny by default and only allow if the
+  // scheme passes the content::ChildProcessSecurityPolicy::IsWebSafeScheme()
+  // check.
+  if (url.SchemeIs(content::kChromeUIScheme))
+    return false;
+
+  // javascript: URLs never make sense as a most visited item either.
+  if (url.SchemeIs(url::kJavaScriptScheme))
+    return false;
+
+  for (const auto& item : most_visited_items_) {
+    if (item.url == url)
+      return true;
+  }
+  for (const auto& item : suggestions_items_) {
+    if (item.url == url)
+      return true;
+  }
+  return false;
+}
+
 void InstantService::OnRendererProcessTerminated(int process_id) {
   process_ids_.erase(process_id);
 
   if (instant_io_context_.get()) {
     content::BrowserThread::PostTask(
         content::BrowserThread::IO, FROM_HERE,
         base::Bind(&InstantIOContext::RemoveInstantProcessOnIO,
                    instant_io_context_, process_id));
   }
 }
@@ skipping 222 matching lines @@
 }
 
 void InstantService::ResetInstantSearchPrerenderer() {
   if (!search::ShouldPrefetchSearchResults())
     return;
 
   GURL url(search::GetSearchResultPrefetchBaseURL(profile_));
   instant_prerenderer_.reset(
       url.is_valid() ? new InstantSearchPrerenderer(profile_, url) : NULL);
 }