NTP: don't allow navigateContentWindow to navigate where it pleases.

chrome/browser/ui/search/search_tab_helper.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/search/search_tab_helper.h"
 
 #include <set>
 
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 432 matching lines @@
       if (!omnibox->model()->popup_model()->IsOpen())
         web_contents()->Focus();
       break;
   }
 #endif
 }
 
 void SearchTabHelper::NavigateToURL(const GURL& url,
                                     WindowOpenDisposition disposition,
                                     bool is_most_visited_item_url) {
+  // Make sure the specified URL is actually on the most visited or suggested
+  // items list.
+  // TODO(treib): The |is_most_visited_item_url| is meaningless: the way it's
+  // currently set by the renderer means it can't be used to decide which list
+  // of items (most visited or suggestions) to use for the validation check. Can
+  // it be removed?
+  if (!instant_service_ || !instant_service_->IsValidURLForNavigation(url))
+    return;
+
   if (is_most_visited_item_url) {
     content::RecordAction(
         base::UserMetricsAction("InstantExtended.MostVisitedClicked"));
   }
 
   if (delegate_)
     delegate_->NavigateOnThumbnailClick(url, disposition, web_contents_);
 }
 
 void SearchTabHelper::OnDeleteMostVisitedItem(const GURL& url) {
@@ skipping 127 matching lines @@
 
 bool SearchTabHelper::IsInputInProgress() const {
   OmniboxView* omnibox = GetOmniboxView();
   return !model_.mode().is_ntp() && omnibox &&
       omnibox->model()->focus_state() == OMNIBOX_FOCUS_VISIBLE;
 }
 
 OmniboxView* SearchTabHelper::GetOmniboxView() const {
   return delegate_ ? delegate_->GetOmniboxView() : NULL;
 }