Declarative resource hints go through mojo IPC to //content

content/browser/loader/resource_hints_impl.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/resource_context.h"
 #include "content/public/browser/resource_hints.h"
 #include "net/base/address_list.h"
@@ skipping 11 matching lines @@
 
 namespace {
 
 // Note that the lifetime of |request| and |addresses| is managed by the caller.
 void OnResolveComplete(net::SingleRequestHostResolver* request,
                        net::AddressList* addresses,
                        const net::CompletionCallback& callback,
                        int result) {
   // Plumb the resolution result into the callback if future consumers want
   // that information.
-  callback.Run(result);
+  if (!callback.is_null())
+    callback.Run(result);
+}
+
+bool ValidUrl(const GURL& url) {
+  return url.is_valid() && url.has_host() && url.has_scheme() &&
+         url.SchemeIsHTTPOrHTTPS();
 }
 
 }  // namespace
 
 void PreconnectUrl(content::ResourceContext* resource_context,
                    const GURL& url,
                    const GURL& first_party_for_cookies,
                    int count,
                    bool allow_credentials,
                    net::HttpRequestInfo::RequestMotivation motivation) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK(resource_context);
 
+  if (!ValidUrl(url))
+    return;
+
   net::URLRequestContext* context = resource_context->GetRequestContext();
   net::HttpTransactionFactory* factory = context->http_transaction_factory();
   net::HttpNetworkSession* session = factory->GetSession();
 
   std::string user_agent;
   if (context->http_user_agent_settings())
     user_agent = context->http_user_agent_settings()->GetUserAgent();
   net::HttpRequestInfo request_info;
   request_info.url = url;
   request_info.method = "GET";
@@ skipping 18 matching lines @@
   net::HttpStreamFactory* http_stream_factory = session->http_stream_factory();
   http_stream_factory->PreconnectStreams(count, request_info);
 }
 
 int PreresolveUrl(content::ResourceContext* resource_context,
                   const GURL& url,
                   const net::CompletionCallback& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK(resource_context);
 
+  if (!ValidUrl(url))
+    return net::ERR_INVALID_URL;
+
   net::AddressList* addresses = new net::AddressList;
   net::SingleRequestHostResolver* resolver =
       new net::SingleRequestHostResolver(resource_context->GetHostResolver());
   net::HostResolver::RequestInfo resolve_info(net::HostPortPair::FromURL(url));
   return resolver->Resolve(resolve_info, net::IDLE, addresses,
                            base::Bind(&OnResolveComplete, base::Owned(resolver),
                                       base::Owned(addresses), callback),
                            net::BoundNetLog());
 }
 
 }  // namespace content