Add URL validation to navigations initiated via RenderFrameProxyHosts.

content/browser/frame_host/render_frame_proxy_host.cc

Index: content/browser/frame_host/render_frame_proxy_host.cc
diff --git a/content/browser/frame_host/render_frame_proxy_host.cc b/content/browser/frame_host/render_frame_proxy_host.cc
index 93dd48b64f559ba50d2a5e49bb036bfd6a804a05..122c34184dc59b1e8cdfd189f712dbb4b23b62ab 100644
--- a/content/browser/frame_host/render_frame_proxy_host.cc
+++ b/content/browser/frame_host/render_frame_proxy_host.cc
@@ -258,10 +258,13 @@ void RenderFrameProxyHost::OnOpenURL(
   // in the current tab.
   DCHECK_EQ(CURRENT_TAB, params.disposition);
 
+  GURL validated_url(params.url);
+  GetProcess()->FilterURL(false, &validated_url);

[Charlie Reis, 2016/03/17 17:22:27]

nit: We usually try to put this as the first thing in the method, so that other
uses of params.url don't creep in above it.

[alexmos, 2016/03/17 17:30:48]

Done.

+
   // TODO(alexmos, creis): Figure out whether |params.user_gesture| needs to be
   // passed in as well.
   frame_tree_node_->navigator()->RequestTransferURL(
-      current_rfh, params.url, site_instance_.get(), std::vector<GURL>(),
+      current_rfh, validated_url, site_instance_.get(), std::vector<GURL>(),
       params.referrer, ui::PAGE_TRANSITION_LINK, GlobalRequestID(),
       params.should_replace_current_entry);
 }