NTP: don't allow navigateContentWindow to navigate where it pleases.

chrome/renderer/searchbox/searchbox_extension.cc

Index: chrome/renderer/searchbox/searchbox_extension.cc
diff --git a/chrome/renderer/searchbox/searchbox_extension.cc b/chrome/renderer/searchbox/searchbox_extension.cc
index 5dc7ae5ac91322ffd16f8e7eede21a2f2d861a8b..84338e011b2b6a1595b8f38b8fff10b2f4b1e9d7 100644
--- a/chrome/renderer/searchbox/searchbox_extension.cc
+++ b/chrome/renderer/searchbox/searchbox_extension.cc
@@ -1165,6 +1165,8 @@ void SearchBoxExtensionWrapper::NavigateContentWindow(
   DVLOG(1) << render_view << " NavigateContentWindow: " << destination_url;
 
   // Navigate the main frame.
+  // TODO(treib): Remove this check, since it's redundant with the browser-side

[Charlie Reis, 2016/02/04 18:37:53]

I disagree with removing this.  It's fine to have the renderer skip the IPC if
it knows the URL won't be allowed, and just have the browser-side check as a
backup.

[dcheng, 2016/02/04 18:41:32]

On the flip side, having it here makes it tempting to add further checks here (I
fell into this trap initially yesterday).

[Charlie Reis, 2016/02/04 18:45:23]

// Navigate the main frame. Note that the safety checks are enforced by the
browser process in InstantService but are useful here for avoiding unnecessary
IPCs.

[dcheng, 2016/02/04 19:05:01]

Done.

+  // check.
   if (destination_url.is_valid() &&
       !destination_url.SchemeIs(url::kJavaScriptScheme)) {
     WindowOpenDisposition disposition = CURRENT_TAB;