Support a different source for fillMostVisited

chrome/browser/resources/local_ntp/most_visited_util.js

Index: chrome/browser/resources/local_ntp/most_visited_util.js
diff --git a/chrome/browser/resources/local_ntp/most_visited_util.js b/chrome/browser/resources/local_ntp/most_visited_util.js
index 088ea6dbaf35ceb19eefba23d01720616e834ec1..a280c216accb0f530329e7f0aa102195132c45b9 100644
--- a/chrome/browser/resources/local_ntp/most_visited_util.js
+++ b/chrome/browser/resources/local_ntp/most_visited_util.js
@@ -107,12 +107,21 @@ function getMostVisitedStyles(params, isTitle) {
 function fillMostVisited(location, fill) {
   var params = parseQueryParams(document.location);
   params.rid = parseInt(params.rid, 10);
-  if (!isFinite(params.rid))
-    return;
-  var apiHandle = chrome.embeddedSearch.searchBox;
-  var data = apiHandle.getMostVisitedItemData(params.rid);
-  if (!data)
+  if (!isFinite(params.rid) && !params.url)
     return;
+  var data = {};
+  if (params.url) {
+    // Means that we get suggestion data from the server. Create data object.

[samarth, 2013/07/19 22:16:40]

These fields are currently set by C++ code in chrome and now you're allowing the
server to set them. I suspect you may need to some extra sanity checks/escaping
to make sure we're not introducing an attack vector. (Remind me how exactly are
these fields used by the downstream JS).

[Mathieu, 2013/07/22 17:32:50]

The downstream code will create title and thumbnail elements inside the iframe
using the fields that we set here in |data| (see
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/res...
for the thumbnail). Notably this will create an image element with src
data.thumbnailUrl, so I've checked it for javascript below, if that is possibly
a vector.

+    data.url = params.url;
+    data.thumbnailUrl = params.tu || '';
+    data.title = params.ti || '';
+    data.direction = params.di || '';
+  } else {
+    var apiHandle = chrome.embeddedSearch.searchBox;
+    data = apiHandle.getMostVisitedItemData(params.rid);
+    if (!data)
+      return;
+  }
   if (/^javascript:/i.test(data.url))
     return;
   if (data.direction)