Add scheme whitelist for content intents

content/public/android/java/src/org/chromium/content/browser/ContentViewClient.java

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package org.chromium.content.browser;
 
 import android.content.ActivityNotFoundException;
 import android.content.Context;
 import android.content.Intent;
 import android.view.KeyEvent;
 import android.view.View.MeasureSpec;
 
 import org.chromium.base.Log;
 
 /**
  *  Main callback class used by ContentView.
  *
  *  This contains the superset of callbacks required to implement the browser UI and the callbacks
  *  required to implement the WebView API.
  *  The memory and reference ownership of this class is unusual - see the .cc file and ContentView
  *  for more details.
  *
  *  TODO(mkosiba): Rid this guy of default implementations. This class is used by both WebView and
  *  the browser and we don't want a the browser-specific default implementation to accidentally leak
  *  over to WebView.
  */
 public class ContentViewClient {
     // Tag used for logging.
-    private static final String TAG = "cr.ContentViewClient";
+    private static final String TAG = "cr_ContentViewClient";
 
     // Default value to signal that the ContentView's size should not be overridden.
     private static final int UNSPECIFIED_MEASURE_SPEC =
             MeasureSpec.makeMeasureSpec(0, MeasureSpec.UNSPECIFIED);
 
+    private static final String GEO_SCHEME = "geo";
+    private static final String TEL_SCHEME = "tel";
+    private static final String MAILTO_SCHEME = "mailto";
+
     public void onUpdateTitle(String title) {
     }
 
     /**
      * Called whenever the background color of the page changes as notified by WebKit.
      * @param color The new ARGB color of the page background.
      */
     public void onBackgroundColorChanged(int color) {
     }
 
@@ skipping 92 matching lines @@
     }
 
     /**
      * Called when a new content intent is requested to be started.
      */
     public void onStartContentIntent(Context context, String intentUrl, boolean isMainFrame) {
         Intent intent;
         // Perform generic parsing of the URI to turn it into an Intent.
         try {
             intent = Intent.parseUri(intentUrl, Intent.URI_INTENT_SCHEME);
+
+            String scheme = intent.getScheme();
+            if (!scheme.equals(GEO_SCHEME) && !scheme.equals(TEL_SCHEME)
+                    && !scheme.equals(MAILTO_SCHEME)) {
+                Log.w(TAG, "Invalid scheme for URI %s", intentUrl);
+                return;
+            }
+
             intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
         } catch (Exception ex) {
             Log.w(TAG, "Bad URI %s", intentUrl, ex);
             return;
         }
 
         try {
             context.startActivity(intent);
         } catch (ActivityNotFoundException ex) {
             Log.w(TAG, "No application can handle %s", intentUrl);
@@ skipping 103 matching lines @@
         return 0;
     }
 
     /**
      * Return the product version.
      */
     public String getProductVersion() {
         return "";
     }
 }