Ignore Javascript urls dropped on tabs (Mac version)

chrome/browser/ui/cocoa/toolbar/toolbar_controller.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "chrome/browser/ui/cocoa/toolbar/toolbar_controller.h"
 
 #include <algorithm>
 
 #include "base/mac/bundle_locations.h"
 #include "base/mac/foundation_util.h"
@@ skipping 1132 matching lines @@
   }
 
   // TODO(viettrungluu): dropping multiple URLs?
   if ([urls count] > 1)
     NOTIMPLEMENTED();
 
   // Get the first URL and fix it up.
   GURL url(url_formatter::FixupURL(
       base::SysNSStringToUTF8([urls objectAtIndex:0]), std::string()));
 
+  // Security: Sanitize text to prevent self-XSS.
   if (url.SchemeIs(url::kJavaScriptScheme)) {
     browser_->window()->GetLocationBar()->GetOmniboxView()->SetUserText(
           OmniboxView::StripJavascriptSchemas(base::UTF8ToUTF16(url.spec())));
+    return;
   }
+
   OpenURLParams params(url, Referrer(), WindowOpenDisposition::CURRENT_TAB,
                        ui::PAGE_TRANSITION_TYPED, false);
   browser_->tab_strip_model()->GetActiveWebContents()->OpenURL(params);
 }
 
 // (URLDropTargetController protocol)
 - (void)dropText:(NSString*)text inView:(NSView*)view at:(NSPoint)point {
   // TODO(viettrungluu): This code is more or less copied from the code in
   // |TabStripController|. I'll refactor this soon to make it common and expand
   // its capabilities (e.g., allow text DnD).
 
   // If the input is plain text, classify the input and make the URL.
   AutocompleteMatch match;
   AutocompleteClassifierFactory::GetForProfile(browser_->profile())->Classify(
       base::SysNSStringToUTF16(text), false, false,
       metrics::OmniboxEventProto::BLANK, &match, NULL);
   GURL url(match.destination_url);
 
+  // Security: Block JavaScript to prevent self-XSS.
+  if (url.SchemeIs(url::kJavaScriptScheme))
+    return;
+
   OpenURLParams params(url, Referrer(), WindowOpenDisposition::CURRENT_TAB,
                        ui::PAGE_TRANSITION_TYPED, false);
   browser_->tab_strip_model()->GetActiveWebContents()->OpenURL(params);
 }
 
 // (URLDropTargetController protocol)
 - (void)indicateDropURLsInView:(NSView*)view at:(NSPoint)point {
   // Do nothing.
 }
 
 // (URLDropTargetController protocol)
 - (void)hideDropURLsIndicatorInView:(NSView*)view {
   // Do nothing.
 }
 
 // (URLDropTargetController protocol)
 - (BOOL)isUnsupportedDropData:(id<NSDraggingInfo>)info {
   return drag_util::IsUnsupportedDropData(profile_, info);
 }
 
 @end