Ignore Javascript urls dropped on tabs (Mac version)

chrome/browser/ui/cocoa/tabs/tab_strip_controller.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "chrome/browser/ui/cocoa/tabs/tab_strip_controller.h"
 
 #import <QuartzCore/QuartzCore.h>
 
 #include <cmath>
 #include <limits>
@@ skipping 2048 matching lines @@
 }
 
 - (void)openURL:(GURL*)url inView:(NSView*)view at:(NSPoint)point {
   // Get the index and disposition.
   NSInteger index;
   WindowOpenDisposition disposition;
   [self droppingURLsAt:point
             givesIndex:&index
            disposition:&disposition];
 
+  // Security: Block JavaScript to prevent self-xss

[Avi (use Gerrit), 2016/09/16 18:31:09]

Comments are full sentences; end them with a full-stop.

[elawrence, 2016/09/16 19:02:16]

Done.

+  if (url->SchemeIs(url::kJavaScriptScheme)) {
+    return;
+  }
+

[Avi (use Gerrit), 2016/09/16 18:31:09]

Why not put this right at the beginning of the function? If we're going to bail
early, bail as early as possible.

And no {} around the one-line body of the if.

[elawrence, 2016/09/16 19:02:16]

Makes sense.
I was trying to match the style elsewhere in this file, but I'm happy to remove.

   // Either insert a new tab or open in a current tab.
   switch (disposition) {
     case WindowOpenDisposition::NEW_FOREGROUND_TAB: {
       content::RecordAction(UserMetricsAction("Tab_DropURLBetweenTabs"));
       chrome::NavigateParams params(browser_, *url,
                                     ui::PAGE_TRANSITION_TYPED);
       params.disposition = disposition;
       params.tabstrip_index = index;
       params.tabstrip_add_types =
           TabStripModel::ADD_ACTIVE | TabStripModel::ADD_FORCE_INDEX;
@@ skipping 254 matching lines @@
   for (int i = 0; i < tabStripModel_->count(); i++) {
     [self updateIconsForContents:tabStripModel_->GetWebContentsAt(i) atIndex:i];
   }
 }
 
 - (void)setVisualEffectsDisabledForFullscreen:(BOOL)fullscreen {
   [tabStripView_ setVisualEffectsDisabledForFullscreen:fullscreen];
 }
 
 @end