Support a different source for fillMostVisited

chrome/browser/resources/local_ntp/most_visited_util.js

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 
 /**
  * @fileoverview Utilities for rendering most visited thumbnails and titles.
  */
 
 <include src="instant_iframe_validation.js">
@@ skipping 89 matching lines @@
 
 
 /**
  * @param {string} location A location containing URL parameters.
  * @param {function(Object, Object)} fill A function called with styles and
  *     data to fill.
  */
 function fillMostVisited(location, fill) {
   var params = parseQueryParams(document.location);
   params.rid = parseInt(params.rid, 10);
-  if (!isFinite(params.rid))
+  if (!isFinite(params.rid) && !params.url)
     return;
-  var apiHandle = chrome.embeddedSearch.searchBox;
-  var data = apiHandle.getMostVisitedItemData(params.rid);
-  if (!data)
-    return;
+  var data = {};
+  if (params.url) {
+    // Means that we get suggestion data from the server. Create data object.

[samarth, 2013/07/19 22:16:40]

These fields are currently set by C++ code in chrome and now you're allowing the
server to set them. I suspect you may need to some extra sanity checks/escaping
to make sure we're not introducing an attack vector. (Remind me how exactly are
these fields used by the downstream JS).

[Mathieu, 2013/07/22 17:32:50]

The downstream code will create title and thumbnail elements inside the iframe
using the fields that we set here in |data| (see
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/res...
for the thumbnail). Notably this will create an image element with src
data.thumbnailUrl, so I've checked it for javascript below, if that is possibly
a vector.

+    data.url = params.url;
+    data.thumbnailUrl = params.tu || '';
+    data.title = params.ti || '';
+    data.direction = params.di || '';
+  } else {
+    var apiHandle = chrome.embeddedSearch.searchBox;
+    data = apiHandle.getMostVisitedItemData(params.rid);
+    if (!data)
+      return;
+  }
   if (/^javascript:/i.test(data.url))
     return;
   if (data.direction)
     document.body.dir = data.direction;
   fill(params, data);
 }