Experiment with blocking resolution of HTTP URLs containing '\n' and '<'.

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 8dd0107b17f40243126d5ebf82ac2ec8a0e5a7b0..3966b1c70dda7a8b93186e52b093bb1e1db19960 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -4947,17 +4947,31 @@ void Document::setEncodingData(const DocumentEncodingData& newData) {
 
 KURL Document::completeURL(const String& url) const {
   String trimmed = url.stripWhiteSpace();
+  KURL completed = completeURLWithOverride(url, m_baseURL);
+
   bool newline = trimmed.contains('\n') || trimmed.contains('\r');
-  bool brace = trimmed.contains('<');
-  if (newline)
-    UseCounter::count(*this, UseCounter::DocumentCompleteURLContainingNewline);
-  if (brace) {
-    UseCounter::count(*this,
-                      UseCounter::DocumentCompleteURLContainingOpenBrace);
-  }
-  if (newline && brace) {
+  bool lessThan = trimmed.contains('<');
+  if ((newline || lessThan) && completed.protocolIsInHTTPFamily()) {
+    if (newline) {
+      UseCounter::count(*this,
+                        UseCounter::DocumentCompleteURLHTTPContainingNewline);
+    }
+    if (lessThan) {
+      UseCounter::count(*this,
+                        UseCounter::DocumentCompleteURLHTTPContainingLessThan);
+    }
+    if (newline && lessThan) {
+      UseCounter::count(
+          *this,
+          UseCounter::DocumentCompleteURLHTTPContainingNewlineAndLessThan);
+
+      if (RuntimeEnabledFeatures::restrictCompleteURLCharacterSetEnabled())
+        return KURL();
+    }
+  } else if (newline || lessThan) {
     UseCounter::count(
-        *this, UseCounter::DocumentCompleteURLContainingNewlineAndOpenBrace);
+        *this,
+        UseCounter::DocumentCompleteURLNonHTTPContainingNewlineOrLessThan);
   }
   return completeURLWithOverride(url, m_baseURL);
 }