Do not sanitize about:blank/#foo & about:blank?foo

content/public/common/url_constants.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_COMMON_URL_CONSTANTS_H_
 #define CONTENT_PUBLIC_COMMON_URL_CONSTANTS_H_
 
 #include "build/build_config.h"
 #include "content/common/content_export.h"
 #include "url/url_constants.h"
 
 // Contains constants for known URLs and portions thereof.
 
 namespace content {
 
 // Canonical schemes you can use as input to GURL.SchemeIs().
 // TODO(jam): some of these don't below in the content layer, but are accessed
 // from there.
 CONTENT_EXPORT extern const char kChromeDevToolsScheme[];
 CONTENT_EXPORT extern const char kChromeUIScheme[];  // Used for WebUIs.
 CONTENT_EXPORT extern const char kGuestScheme[];
 CONTENT_EXPORT extern const char kViewSourceScheme[];
 #if defined(OS_CHROMEOS)
 CONTENT_EXPORT extern const char kExternalFileScheme[];
 #endif
 
 // Hosts for about URLs.
 CONTENT_EXPORT extern const char kAboutSrcDocURL[];
 
+CONTENT_EXPORT extern const char kAboutBlankPath[];

[clamy, 2017/01/19 17:54:51]

Note: I've put all this in this file since it seemed to be the only file in
content/ with url constants, even though I'm not using it outside of content/.
If you have a suggestion for a better place to put it that'd be nice.

[Charlie Reis, 2017/01/19 22:36:35]

I was going to suggest content/common/content_constants_internal.h, but I wonder
if it's better to add an external use in this CL and just keep it public.  That
may help us understand this a bit more as well.

For example, from a quick glance I noticed WillHandleBrowserAboutURL in
chrome/browser/browser_about_handler.cc, which DCHECKs if the URL has an about:
scheme but isn't equal to kAboutBlankURL.  That pointed me to FixupURL in
components/url_formatter/url_fixer.cc, which rewrites any about: URLs to chrome:
URLs unless they're equal to kAboutBlankURL.  And indeed, we seem to have a bug
where you can't type about:blank/#foo into the omnibox!  (Firefox supports this;
Edge does not.)

This isn't high impact to users, but maybe it's worth correcting?  If so, maybe
your IsAboutBlankURL utility and these constants actually belong in
url/url_util.h and url/url_constants.h?  mkwst@ may have thoughts on this.

[clamy, 2017/01/20 12:51:53]

As per mkwst@ input, I've moved this to url/.

+CONTENT_EXPORT extern const char kAboutBlankWithHashPath[];
+
 CONTENT_EXPORT extern const char kChromeUIAccessibilityHost[];
 CONTENT_EXPORT extern const char kChromeUIAppCacheInternalsHost[];
 CONTENT_EXPORT extern const char kChromeUIBlobInternalsHost[];
 CONTENT_EXPORT extern const char kChromeUIBrowserCrashHost[];
 CONTENT_EXPORT extern const char kChromeUIDinoHost[];
 CONTENT_EXPORT extern const char kChromeUIGpuHost[];
 CONTENT_EXPORT extern const char kChromeUIHistogramHost[];
 CONTENT_EXPORT extern const char kChromeUIHistoryHost[];
 CONTENT_EXPORT extern const char kChromeUIIndexedDBInternalsHost[];
 CONTENT_EXPORT extern const char kChromeUIMediaInternalsHost[];
@@ skipping 29 matching lines @@
 CONTENT_EXPORT extern const char kUnreachableWebDataURL[];
 
 // Full about URLs (including schemes).
 CONTENT_EXPORT extern const char kChromeUINetworkViewCacheURL[];
 CONTENT_EXPORT extern const char kChromeUIResourcesURL[];
 CONTENT_EXPORT extern const char kChromeUIShorthangURL[];
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_COMMON_URL_CONSTANTS_H_