[DevTools] Whitelist remoteFrontendUrl and remoteBase params.

third_party/WebKit/Source/devtools/front_end/devtools.js

Index: third_party/WebKit/Source/devtools/front_end/devtools.js
diff --git a/third_party/WebKit/Source/devtools/front_end/devtools.js b/third_party/WebKit/Source/devtools/front_end/devtools.js
index f3a91417f68c5ed57a954f58d7eafead6c55e625..1b278045a32cb793cbcf07b635e0bcfe57c602aa 100644
--- a/third_party/WebKit/Source/devtools/front_end/devtools.js
+++ b/third_party/WebKit/Source/devtools/front_end/devtools.js
@@ -985,6 +985,8 @@ function installObjectObserve()
  */
 function sanitizeRemoteFrontendUrl()
 {
+    var remoteBaseRegexp = /^https:\/\/chrome-devtools-frontend\.appspot\.com\/serve_file\/@[0-9a-zA-Z]+\/?$/;

[caseq, 2016/06/16 12:51:16]

nit: consider extracting a constant. also, perhaps just use [\w] for brevity?

[dgozman, 2016/06/20 19:05:56]

These two files cannot share any code.

+    var remoteFrontendUrlRegexp = /^https:\/\/chrome-devtools-frontend\.appspot\.com\/serve_rev\/@?[0-9a-zA-Z]+\/(devtools|inspector)\.html$/;
     var queryParams = location.search;
     if (!queryParams)
         return;
@@ -993,7 +995,9 @@ function sanitizeRemoteFrontendUrl()
         var pair = params[i].split("=");
         var name = pair.shift();
         var value = pair.join("=");
-        if (name === "remoteFrontendUrl" && !value.startsWith("https://chrome-devtools-frontend.appspot.com/"))
+        if (name === "remoteFrontendUrl" && !remoteFrontendUrlRegexp.test(value))
+            location.search = "";
+        if (name === "remoteBase" && !remoteBaseRegexp.test(value))
             location.search = "";
     }
 }