[HBD] Blanket BLOCK on all non-HTTP(s) and non-FILE URLs for Flash.

chrome/renderer/chrome_content_renderer_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_content_renderer_client.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 545 matching lines @@
 #if defined(ENABLE_EXTENSIONS)
   if (!ChromeExtensionsRendererClient::GetInstance()->OverrideCreatePlugin(
           render_frame, params)) {
     return false;
   }
 #endif
 
   GURL url(params.url);
 #if defined(ENABLE_PLUGINS)
   ChromeViewHostMsg_GetPluginInfo_Output output;
-  WebString top_origin = frame->top()->getSecurityOrigin().toString();

[tommycli, 2016/09/30 00:42:37]

Here was where the issue was: WebSecurityOrigin.toString() makes file:// URLs
null.

My solution was just to pass everything through as url::Origin so we have more
control over it.

   render_frame->Send(new ChromeViewHostMsg_GetPluginInfo(
-      render_frame->GetRoutingID(), url, blink::WebStringToGURL(top_origin),
+      render_frame->GetRoutingID(), url, frame->top()->getSecurityOrigin(),
       orig_mime_type, &output));
   *plugin = CreatePlugin(render_frame, frame, params, output);
 #else  // !defined(ENABLE_PLUGINS)
 
 #if defined(OS_ANDROID)
   if (plugins::MobileYouTubePlugin::IsYouTubeURL(url, orig_mime_type)) {
     base::StringPiece template_html(
         ResourceBundle::GetSharedInstance().GetRawDataResource(
             IDR_MOBILE_YOUTUBE_PLUGIN_HTML));
     *plugin = (new plugins::MobileYouTubePlugin(render_frame, frame, params,
@@ skipping 880 matching lines @@
 
   url::Replacements<char> r;
   r.SetPath(path.c_str(), url::Component(0, path.length()));
 
   if (result == internal::NUM_PLUGIN_ERROR)
     result = invalid_url ? internal::SUCCESS_PARAMS_REWRITE : internal::SUCCESS;
 
   RecordYouTubeRewriteUMA(result);
   return corrected_url.ReplaceComponents(r);
 }