Invalidate the page state when restoring WebUIs

components/sessions/content/content_serialized_navigation_driver.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/sessions/content/content_serialized_navigation_driver.h"
 
 #include "base/memory/singleton.h"
 #include "build/build_config.h"
 #include "components/sessions/core/serialized_navigation_entry.h"
 #include "content/public/common/page_state.h"
@@ skipping 85 matching lines @@
 
 void ContentSerializedNavigationDriver::Sanitize(
     SerializedNavigationEntry* navigation) const {
   content::Referrer old_referrer(
       navigation->referrer_url_,
       static_cast<blink::WebReferrerPolicy>(navigation->referrer_policy_));
   content::Referrer new_referrer =
       content::Referrer::SanitizeForRequest(navigation->virtual_url_,
                                             old_referrer);
 
+  // Clear any WebUI page state.
+  if (navigation->virtual_url_.SchemeIs(content::kChromeUIScheme) &&
+      navigation->original_request_url_.SchemeIs(content::kChromeUIScheme)) {
+    navigation->encoded_page_state_ = std::string();
+  }
+
   // No need to compare the policy, as it doesn't change during
   // sanitization. If there has been a change, the referrer needs to be
   // stripped from the page state as well.
   if (navigation->referrer_url_ != new_referrer.url) {
     navigation->referrer_url_ = GURL();
     navigation->referrer_policy_ = GetDefaultReferrerPolicy();
     navigation->encoded_page_state_ =
         StripReferrerFromPageState(navigation->encoded_page_state_);
   }
 
@@ skipping 11 matching lines @@
 }
 
 std::string ContentSerializedNavigationDriver::StripReferrerFromPageState(
       const std::string& page_state) const {
   return content::PageState::CreateFromEncodedData(page_state)
       .RemoveReferrer()
       .ToEncodedData();
 }
 
 }  // namespace sessions