WebView: Add scheme whitelist for content intents.

android_webview/java/src/org/chromium/android_webview/AwContentViewClient.java

Index: android_webview/java/src/org/chromium/android_webview/AwContentViewClient.java
diff --git a/android_webview/java/src/org/chromium/android_webview/AwContentViewClient.java b/android_webview/java/src/org/chromium/android_webview/AwContentViewClient.java
index f109688a8977e63aa18d25d6893a344eaf113729..98622d8327c13f081e08099b1ff1a46c36870f86 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwContentViewClient.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwContentViewClient.java
@@ -5,14 +5,20 @@
 package org.chromium.android_webview;
 
 import android.content.Context;
+import android.content.Intent;
 import android.view.KeyEvent;
 
+import org.chromium.base.Log;
 import org.chromium.content.browser.ContentViewClient;
 
+import java.net.URISyntaxException;
+
 /**
  * ContentViewClient implementation for WebView
  */
 public class AwContentViewClient extends ContentViewClient {
+    private static final String TAG = "AwCVC";
+
     private final AwContentsClient mAwContentsClient;
     private final AwSettings mAwSettings;
     private final AwContents mAwContents;
@@ -33,6 +39,20 @@ public class AwContentViewClient extends ContentViewClient {
 
     @Override
     public void onStartContentIntent(Context context, String contentUrl, boolean isMainFrame) {
+        // Make sure that this URL is a valid scheme for this callback if interpreted as an intent,
+        // even though we don't dispatch it as an intent here, because many WebView apps will once
+        // it reaches them.
+        String scheme = null;
+        try {
+            Intent intent = Intent.parseUri(contentUrl, Intent.URI_INTENT_SCHEME);
+            scheme = intent.getScheme();
+        } catch (URISyntaxException e) {
+            // Just don't set the scheme, it will be rejected.
+        }
+        if (!isAcceptableContentIntentScheme(scheme)) {
+            Log.w(TAG, "Invalid scheme for URI %s", contentUrl);
+            return;
+        }
         // Comes from WebViewImpl::detectContentOnTouch in Blink, so must be user-initiated, and
         // isn't a redirect.
         mAwContentsClient.shouldIgnoreNavigation(context, contentUrl, isMainFrame, true, false);