Do not allow HTTP refresh headers to refresh to javascript: URLs.

Source/core/loader/FrameLoader.cpp

Index: Source/core/loader/FrameLoader.cpp
diff --git a/Source/core/loader/FrameLoader.cpp b/Source/core/loader/FrameLoader.cpp
index cf14b35d122851d3947b1f44e8e8d29dd3bc2eda..c68edaa75a1c70f0d20f0ecafb9da94a4c39a8b7 100644
--- a/Source/core/loader/FrameLoader.cpp
+++ b/Source/core/loader/FrameLoader.cpp
@@ -538,7 +538,12 @@ void FrameLoader::receivedFirstData()
     else
         url = m_frame->document()->completeURL(url).string();
 
-    m_frame->navigationScheduler()->scheduleRedirect(delay, url);
+    if (!protocolIsJavaScript(url)) {
+        m_frame->navigationScheduler()->scheduleRedirect(delay, url);
+    } else {
+        String message = "Refused to refresh " + m_frame->document()->url().elidedString() + " to a javascript: URL";
+        m_frame->document()->addConsoleMessage(SecurityMessageSource, ErrorMessageLevel, message);
+    }
 }
 
 void FrameLoader::setOutgoingReferrer(const KURL& url)