[ios] Do not allow WebUI URLs for windows open by DOM.

[ios] Do not allow WebUI URLs for windows open by DOM.

BUG=639658
Committed: https://crrev.com/5bdbf8b4a257e3264644900234c1d31126394c5f
Cr-Commit-Position: refs/heads/master@{#413834}

[Eugene But (OOO till 7-30), 2016-08-22 23:56:47]

eugenebut@chromium.org changed reviewers:
+ jyquinn@chromium.org

[Jackie Quinn, 2016-08-23 02:23:05]

LGTM with comment suggestions

https://codereview.chromium.org/2268053002/diff/1/ios/web/web_state/ui/crw_we...
File ios/web/web_state/ui/crw_web_controller.mm (right):

https://codereview.chromium.org/2268053002/diff/1/ios/web/web_state/ui/crw_we...
ios/web/web_state/ui/crw_web_controller.mm:2050: // WebUI URLs can not be open
By DOM to prevent cross-site scripting as
s/open By/opened by

https://codereview.chromium.org/2268053002/diff/1/ios/web/web_state/ui/crw_we...
ios/web/web_state/ui/crw_web_controller.mm:2051: // they have increased power.
The only exception is when the user has
Maybe "WebUI URLs may only be opened when the user types in the URL"

Also does that cover the bookmarked WebUI URL case?

[Eugene But (OOO till 7-30), 2016-08-23 17:41:03]

Thanks!

https://codereview.chromium.org/2268053002/diff/1/ios/web/web_state/ui/crw_we...
File ios/web/web_state/ui/crw_web_controller.mm (right):

https://codereview.chromium.org/2268053002/diff/1/ios/web/web_state/ui/crw_we...
ios/web/web_state/ui/crw_web_controller.mm:2050: // WebUI URLs can not be open
By DOM to prevent cross-site scripting as
On 2016/08/23 02:23:05, Jackie Quinn wrote:
> s/open By/opened by

Done.

https://codereview.chromium.org/2268053002/diff/1/ios/web/web_state/ui/crw_we...
ios/web/web_state/ui/crw_web_controller.mm:2051: // they have increased power.
The only exception is when the user has
On 2016/08/23 02:23:05, Jackie Quinn wrote:
> Maybe "WebUI URLs may only be opened when the user types in the URL"
> 
> Also does that cover the bookmarked WebUI URL case?
Good catch. Added bookmarks handling (which also accounts for history) and
updated the comment.

[Eugene But (OOO till 7-30), 2016-08-23 17:46:14]

The CQ bit was checked by eugenebut@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-23 17:46:33]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-23 18:40:52]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-23 18:40:53]

Dry run: This issue passed the CQ dry run.

[Jackie Quinn, 2016-08-23 20:59:53]

On 2016/08/23 17:41:03, Eugene But wrote:
> Thanks!
> 
>
https://codereview.chromium.org/2268053002/diff/1/ios/web/web_state/ui/crw_we...
> File ios/web/web_state/ui/crw_web_controller.mm (right):
> 
>
https://codereview.chromium.org/2268053002/diff/1/ios/web/web_state/ui/crw_we...
> ios/web/web_state/ui/crw_web_controller.mm:2050: // WebUI URLs can not be open
> By DOM to prevent cross-site scripting as
> On 2016/08/23 02:23:05, Jackie Quinn wrote:
> > s/open By/opened by
> 
> Done.
> 
>
https://codereview.chromium.org/2268053002/diff/1/ios/web/web_state/ui/crw_we...
> ios/web/web_state/ui/crw_web_controller.mm:2051: // they have increased power.
> The only exception is when the user has
> On 2016/08/23 02:23:05, Jackie Quinn wrote:
> > Maybe "WebUI URLs may only be opened when the user types in the URL"
> > 
> > Also does that cover the bookmarked WebUI URL case?
> Good catch. Added bookmarks handling (which also accounts for history) and
> updated the comment.

thanks, still lgtm :-)

[Eugene But (OOO till 7-30), 2016-08-23 21:04:39]

The CQ bit was checked by eugenebut@chromium.org

[commit-bot: I haz the power, 2016-08-23 21:05:13]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-23 21:11:46]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-08-23 21:14:52]

Description was changed from

==========
[ios] Do not allow WebUI URLs for windows open by DOM.

BUG=639658
==========

to

==========
[ios] Do not allow WebUI URLs for windows open by DOM.

BUG=639658

Committed: https://crrev.com/5bdbf8b4a257e3264644900234c1d31126394c5f
Cr-Commit-Position: refs/heads/master@{#413834}
==========

[commit-bot: I haz the power, 2016-08-23 21:14:53]

Patchset 3 (id:??) landed as
https://crrev.com/5bdbf8b4a257e3264644900234c1d31126394c5f
Cr-Commit-Position: refs/heads/master@{#413834}