[DevTools] Whitelist remoteFrontendUrl and remoteBase params.

third_party/WebKit/Source/devtools/front_end/devtools.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /* eslint-disable indent */
 (function(window) {
 
 // DevToolsAPI ----------------------------------------------------------------
 
 /**
@@ skipping 967 matching lines @@
     }
 
     window.Object.observe = objectObserve;
 }
 
 /**
  * @suppressGlobalPropertiesCheck
  */
 function sanitizeRemoteFrontendUrl()
 {
+    var remoteBaseRegexp = /^https:\/\/chrome-devtools-frontend\.appspot\.com\/serve_file\/@[0-9a-zA-Z]+\/?$/;

[caseq, 2016/06/16 12:51:16]

nit: consider extracting a constant. also, perhaps just use [\w] for brevity?

[dgozman, 2016/06/20 19:05:56]

These two files cannot share any code.

+    var remoteFrontendUrlRegexp = /^https:\/\/chrome-devtools-frontend\.appspot\.com\/serve_rev\/@?[0-9a-zA-Z]+\/(devtools|inspector)\.html$/;
     var queryParams = location.search;
     if (!queryParams)
         return;
     var params = queryParams.substring(1).split("&");
     for (var i = 0; i < params.length; ++i) {
         var pair = params[i].split("=");
         var name = pair.shift();
         var value = pair.join("=");
-        if (name === "remoteFrontendUrl" && !value.startsWith("https://chrome-devtools-frontend.appspot.com/"))
+        if (name === "remoteFrontendUrl" && !remoteFrontendUrlRegexp.test(value))
+            location.search = "";
+        if (name === "remoteBase" && !remoteBaseRegexp.test(value))
             location.search = "";
     }
 }
 
 /**
  * @suppressGlobalPropertiesCheck
  */
 function installBackwardsCompatibility()
 {
     sanitizeRemoteFrontendUrl();
@@ skipping 64 matching lines @@
 
 if (!DOMTokenList.prototype.__originalDOMTokenListToggle) {
     DOMTokenList.prototype.__originalDOMTokenListToggle = DOMTokenList.prototype.toggle;
     DOMTokenList.prototype.toggle = function(token, force)
     {
         if (arguments.length === 1)
             force = !this.contains(token);
         return this.__originalDOMTokenListToggle(token, !!force);
     }
 }