Fix XSS in app launcher and remove use of unvalidated URL

chrome/browser/resources/ntp4/apps_page.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 cr.define('ntp', function() {
   'use strict';
 
   var APP_LAUNCH = {
     // The histogram buckets (keep in sync with extension_constants.h).
     NTP_APPS_MAXIMIZED: 0,
@@ skipping 378 matching lines @@
     },
 
     /**
      * Invoked when an app is clicked.
      * @param {Event} e The click/auxclick event.
      * @private
      */
     onClick_: function(e) {
       if (/** @type {MouseEvent} */(e).button > 1) return;
 
-      var url = !this.appData_.is_webstore ? '' :
-          appendParam(this.appData_.url,
-                      'utm_source',
-                      'chrome-ntp-icon');
-
       chrome.send('launchApp',
-                  [this.appId, APP_LAUNCH.NTP_APPS_MAXIMIZED, url,
+                  [this.appId, APP_LAUNCH.NTP_APPS_MAXIMIZED, 'chrome-ntp-icon',
                    e.button, e.altKey, e.ctrlKey, e.metaKey, e.shiftKey]);
 
       // Don't allow the click to trigger a link or anything
       e.preventDefault();
     },
 
     /**
      * Invoked when the user presses a key while the app is focused.
      * @param {Event} e The key event.
      * @private
@@ skipping 286 matching lines @@
       var url = dataTransfer.getData('url');
       assert(url);
 
       // If the dataTransfer has html data, use that html's text contents as the
       // title of the new link.
       var html = dataTransfer.getData('text/html');
       var title;
       if (html) {
         // It's important that we don't attach this node to the document
         // because it might contain scripts.
-        var node = this.ownerDocument.createElement('div');
-        node.innerHTML = html;
-        title = node.textContent;
+        var doc = document.implementation.createHTMLDocument();
+        doc.body.innerHTML = html;
+        title = doc.body.textContent;
       }
 
       // Make sure title is >=1 and <=45 characters for Chrome app limits.
       if (!title)
         title = url;
       if (title.length > 45)
         title = title.substring(0, 45);
       var data = {url: url, title: title};
 
       // Synthesize an app.
@@ skipping 49 matching lines @@
     chrome.send('launchApp', [appId, APP_LAUNCH.NTP_APP_RE_ENABLE]);
   }
 
   return {
     APP_LAUNCH: APP_LAUNCH,
     App: App,
     AppsPage: AppsPage,
     launchAppAfterEnable: launchAppAfterEnable,
   };
 });