NTP: don't allow navigateContentWindow to navigate where it pleases.

chrome/renderer/searchbox/searchbox_extension.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/searchbox/searchbox_extension.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include "base/command_line.h"
@@ skipping 1146 matching lines @@
     }
   } else {
     // Resolve the URL
     const base::string16& possibly_relative_url = V8ValueToUTF16(args[0]);
   GURL current_url = GetCurrentURL(render_view);
     destination_url = internal::ResolveURL(current_url, possibly_relative_url);
   }
 
   DVLOG(1) << render_view << " NavigateContentWindow: " << destination_url;
 
-  // Navigate the main frame.
+  // Navigate the main frame. Note that the security checks are enforced by the
+  // browser process in InstantService::IsValidURLForNavigation(), but some
+  // simple checks here are useful for avoiding unnecessary IPCs.
   if (destination_url.is_valid() &&
       !destination_url.SchemeIs(url::kJavaScriptScheme)) {
     WindowOpenDisposition disposition = CURRENT_TAB;
     if (args[1]->IsNumber()) {
       disposition = (WindowOpenDisposition) args[1]->Uint32Value();
     }
     SearchBox::Get(render_view)->NavigateToURL(destination_url, disposition,
                                                is_most_visited_item_url);
   }
 }
@@ skipping 66 matching lines @@
   if (!render_view) return;
 
   bool display_instant_results =
       SearchBox::Get(render_view)->display_instant_results();
   DVLOG(1) << render_view << " GetDisplayInstantResults" <<
       display_instant_results;
   args.GetReturnValue().Set(display_instant_results);
 }
 
 }  // namespace extensions_v8