Ignore Javascript urls dropped on tabs

chrome/browser/ui/views/tabs/tab_strip.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/views/tabs/tab_strip.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <iterator>
@@ skipping 1608 matching lines @@
     if (url.SchemeIsFile())
       controller_->CheckFileSupported(url);
   }
 }
 
 int TabStrip::OnDragUpdated(const DropTargetEvent& event) {
   // Update the drop index even if the file is unsupported, to allow
   // dragging a file to the contents of another tab.
   UpdateDropIndex(event);
 
-  if (!drop_info_->file_supported)
+  if (!drop_info_->file_supported ||
+      drop_info_->url.SchemeIs(url::kJavaScriptScheme))
     return ui::DragDropTypes::DRAG_NONE;
 
   return GetDropEffect(event);
 }
 
 void TabStrip::OnDragExited() {
   SetDropIndex(-1, false);
 }
 
 int TabStrip::OnPerformDrop(const DropTargetEvent& event) {
   if (!drop_info_.get())
     return ui::DragDropTypes::DRAG_NONE;
 
   const int drop_index = drop_info_->drop_index;
   const bool drop_before = drop_info_->drop_before;
   const bool file_supported = drop_info_->file_supported;
 
   // Hide the drop indicator.
   SetDropIndex(-1, false);
 
-  // Do nothing if the file was unsupported or the URL is invalid. The URL may
-  // have been changed after |drop_info_| was created.
+  // Do nothing if the file was unsupported, the URL is invalid, or this is a
+  // javascript: URL (prevent self-xss). The URL may have been changed after
+  // |drop_info_| was created.
   GURL url;
   base::string16 title;
   if (!file_supported ||
       !event.data().GetURLAndTitle(
            ui::OSExchangeData::CONVERT_FILENAMES, &url, &title) ||
-      !url.is_valid())
+      !url.is_valid() ||
+      url.SchemeIs(url::kJavaScriptScheme))
     return ui::DragDropTypes::DRAG_NONE;
 
   controller_->PerformDrop(drop_before, drop_index, url);
 
   return GetDropEffect(event);
 }
 
 void TabStrip::GetAccessibleState(ui::AXViewState* state) {
   state->role = ui::AX_ROLE_TAB_LIST;
 }
@@ skipping 1218 matching lines @@
           ConvertPointToViewAndGetEventHandler(this, newtab_button_, point);
       if (view)
         return view;
     }
     Tab* tab = FindTabForEvent(point);
     if (tab)
       return ConvertPointToViewAndGetEventHandler(this, tab, point);
   }
   return this;
 }