[DevTools] Whitelist remoteFrontendUrl and remoteBase params.

third_party/WebKit/Source/devtools/front_end/Runtime.js

 /*
  * Copyright (C) 2014 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 103 matching lines @@
 {
     /** @type {!Array<!Promise<undefined>>} */
     var promises = [];
     /** @type {!Array<string>} */
     var urls = [];
     var sources = new Array(scriptNames.length);
     var scriptToEval = 0;
     for (var i = 0; i < scriptNames.length; ++i) {
         var scriptName = scriptNames[i];
         var sourceURL = (base || self._importScriptPathPrefix) + scriptName;
+
         var schemaIndex = sourceURL.indexOf("://") + 3;
-        sourceURL = sourceURL.substring(0, schemaIndex) + normalizePath(sourceURL.substring(schemaIndex));
+        var pathIndex = sourceURL.indexOf("/", schemaIndex);
+        if (pathIndex === -1)
+            pathIndex = sourceURL.length;
+        sourceURL = sourceURL.substring(0, pathIndex) + normalizePath(sourceURL.substring(pathIndex));
+
         if (_loadedScripts[sourceURL])
             continue;
         urls.push(sourceURL);
         promises.push(loadResourcePromise(sourceURL).then(scriptSourceLoaded.bind(null, i), scriptSourceLoaded.bind(null, i, undefined)));
     }
     return Promise.all(promises).then(undefined);
 
     /**
      * @param {number} scriptNumber
      * @param {string=} scriptSource
@@ skipping 1017 matching lines @@
 
 // This must be constructed after the query parameters have been parsed.
 Runtime.experiments = new Runtime.ExperimentsSupport();
 
 /**
  * @type {?string}
  */
 Runtime._remoteBase = Runtime.queryParam("remoteBase");
 {(function validateRemoteBase()
 {
-    if (Runtime._remoteBase && !Runtime._remoteBase.startsWith("https://chrome-devtools-frontend.appspot.com/"))
+    var remoteBaseRegexp = /^https:\/\/chrome-devtools-frontend\.appspot\.com\/serve_file\/@[0-9a-zA-Z]+\/?$/;
+    if (Runtime._remoteBase && !remoteBaseRegexp.test(Runtime._remoteBase))
         Runtime._remoteBase = null;
 })();}
 
 /**
  * @param {string} path
  * @return {string}
  */
 Runtime.resolveSourceURL = function(path)
 {
     var sourceURL = self.location.href;
     if (self.location.search)
         sourceURL = sourceURL.replace(self.location.search, "");
     sourceURL = sourceURL.substring(0, sourceURL.lastIndexOf("/") + 1) + path;
     return "\n/*# sourceURL=" + sourceURL + " */";
 }
 
 /** @type {!Runtime} */
 var runtime;