Ignore Javascript urls dropped on tabs

chrome/browser/ui/views/tabs/tab_strip.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/views/tabs/tab_strip.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <iterator>
@@ skipping 1611 matching lines @@
 }
 
 int TabStrip::OnDragUpdated(const DropTargetEvent& event) {
   // Update the drop index even if the file is unsupported, to allow
   // dragging a file to the contents of another tab.
   UpdateDropIndex(event);
 
   if (!drop_info_->file_supported)
     return ui::DragDropTypes::DRAG_NONE;
 
+  if ((drop_info_->url).SchemeIs(url::kJavaScriptScheme))

[Peter Kasting, 2016/09/09 20:43:06]

Nit: Remove unnecessary first set of parens.  Combine with conditional above.

[elawrence, 2016/09/12 21:42:58]

Done.

+    return ui::DragDropTypes::DRAG_NONE;
+
   return GetDropEffect(event);
 }
 
 void TabStrip::OnDragExited() {
   SetDropIndex(-1, false);
 }
 
 int TabStrip::OnPerformDrop(const DropTargetEvent& event) {
   if (!drop_info_.get())
     return ui::DragDropTypes::DRAG_NONE;
 
   const int drop_index = drop_info_->drop_index;
   const bool drop_before = drop_info_->drop_before;
   const bool file_supported = drop_info_->file_supported;
 
   // Hide the drop indicator.
   SetDropIndex(-1, false);
 
   // Do nothing if the file was unsupported or the URL is invalid. The URL may

[Peter Kasting, 2016/09/09 20:43:06]

Nit: "...the file is unsupported, the URL is invalid, or this is a javascript:
URL (for self-XSS prevention)."

[elawrence, 2016/09/12 21:42:58]

Done.

   // have been changed after |drop_info_| was created.
   GURL url;
   base::string16 title;
   if (!file_supported ||
       !event.data().GetURLAndTitle(
            ui::OSExchangeData::CONVERT_FILENAMES, &url, &title) ||
-      !url.is_valid())
+      !url.is_valid() ||
+      url.SchemeIs(url::kJavaScriptScheme))
     return ui::DragDropTypes::DRAG_NONE;
 
   controller_->PerformDrop(drop_before, drop_index, url);
 
   return GetDropEffect(event);
 }
 
 void TabStrip::GetAccessibleState(ui::AXViewState* state) {
   state->role = ui::AX_ROLE_TAB_LIST;
 }
@@ skipping 1218 matching lines @@
           ConvertPointToViewAndGetEventHandler(this, newtab_button_, point);
       if (view)
         return view;
     }
     Tab* tab = FindTabForEvent(point);
     if (tab)
       return ConvertPointToViewAndGetEventHandler(this, tab, point);
   }
   return this;
 }