NTP: don't allow navigateContentWindow to navigate where it pleases.

chrome/browser/search/instant_service_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 #include <vector>
 
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/field_trial.h"
 #include "base/strings/string_util.h"
@@ skipping 32 matching lines @@
 
   void TearDown() override {
     instant_service_->RemoveObserver(instant_service_observer_.get());
     InstantUnitTestBase::TearDown();
   }
 
   InstantSearchPrerenderer* GetInstantSearchPrerenderer() {
     return instant_service_->instant_search_prerenderer();
   }
 
+  std::vector<InstantMostVisitedItem>& most_visited_items() {
+    return instant_service_->most_visited_items_;
+  }
+
+  std::vector<InstantMostVisitedItem>& suggestions_items() {
+    return instant_service_->suggestions_items_;
+  }
+
   scoped_ptr<MockInstantServiceObserver> instant_service_observer_;
 };
 
 class InstantServiceEnabledTest : public InstantServiceTest {
  protected:
   void SetUp() override {
     ASSERT_TRUE(base::FieldTrialList::CreateFieldTrial(
         "EmbeddedSearch", "Group1 use_cacheable_ntp:1"));
     InstantServiceTest::SetUp();
   }
@@ skipping 105 matching lines @@
 TEST_F(InstantServiceTest, GetSuggestionFromClientSide) {
   history::MostVisitedURLList url_list;
   url_list.push_back(history::MostVisitedURL());
 
   instant_service_->OnMostVisitedItemsReceived(url_list);
 
   auto items = instant_service_->most_visited_items_;
   ASSERT_EQ(1, (int)items.size());
   ASSERT_FALSE(items[0].is_server_side_suggestion);
 }
+
+TEST_F(InstantServiceTest, IsValidURLForNavigation) {
+  // chrome:// URLs should never appear in the most visited items list, but even
+  // if it does, deny navigation anyway.
+  InstantMostVisitedItem settings_item;
+  settings_item.url = GURL("chrome://settings");
+  most_visited_items().push_back(settings_item);
+  EXPECT_FALSE(instant_service_->IsValidURLForNavigation(settings_item.url));
+
+  // If a chrome-extension:// URL appears in the most visited items list, allow
+  // navigation to it.
+  InstantMostVisitedItem extension_item;
+  extension_item.url = GURL("chrome-extension://awesome");
+  most_visited_items().push_back(extension_item);
+  EXPECT_TRUE(instant_service_->IsValidURLForNavigation(extension_item.url));
+
+  // The renderer filters out javascript:// URLs so we should never receive a
+  // request to navigate to one. But if we do, deny it.
+  InstantMostVisitedItem js_item;
+  js_item.url = GURL("javascript:'moo'");
+  most_visited_items().push_back(js_item);
+  EXPECT_FALSE(instant_service_->IsValidURLForNavigation(js_item.url));
+
+  // Normal case: a request for a web safe URL in the most visited items should
+  // be allowed.
+  InstantMostVisitedItem example_item;
+  example_item.url = GURL("https://example.com");
+  most_visited_items().push_back(example_item);
+  EXPECT_TRUE(instant_service_->IsValidURLForNavigation(example_item.url));
+
+  // Normal case: a request for a web safe URL in the most visited items should
+  // be allowed as well.
+  InstantMostVisitedItem chromium_item;
+  chromium_item.url = GURL("https://chromium.org");
+  suggestions_items().push_back(chromium_item);
+  EXPECT_TRUE(instant_service_->IsValidURLForNavigation(chromium_item.url));
+
+  // http://chromium.org is web safe, but not in |suggestions_items_| or
+  // |most_visited_items_|, so it should be denied.
+  EXPECT_FALSE(
+      instant_service_->IsValidURLForNavigation(GURL("http://chromium.org")));
+}