Block renderer-initiated main frame navigations to data URLs

content/browser/frame_host/data_url_navigation_throttle.cc

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/frame_host/data_url_navigation_throttle.h"
+
+#include "base/memory/ptr_util.h"
+#include "base/strings/stringprintf.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/common/browser_side_navigation_policy.h"
+#include "content/public/common/console_message_level.h"
+#include "url/url_constants.h"
+
+namespace content {
+
+namespace {
+const char kConsoleError[] =
+    "Not allowed to top-level navigate to resource: %s";
+}
+
+DataUrlNavigationThrottle::DataUrlNavigationThrottle(
+    NavigationHandle* navigation_handle)
+    : NavigationThrottle(navigation_handle) {}
+
+DataUrlNavigationThrottle::~DataUrlNavigationThrottle() {}
+
+NavigationThrottle::ThrottleCheckResult
+DataUrlNavigationThrottle::WillProcessResponse() {
+  if (navigation_handle()->GetURL().SchemeIs(url::kDataScheme) &&
+      navigation_handle()->IsInMainFrame() &&
+      navigation_handle()->IsRendererInitiated() &&
+      !navigation_handle()->IsDownload()) {
+    navigation_handle()->GetRenderFrameHost()->AddMessageToConsole(
+        CONSOLE_MESSAGE_LEVEL_ERROR,
+        base::StringPrintf(kConsoleError,
+                           navigation_handle()->GetURL().spec().c_str()));
+    return CANCEL;
+  }
+  return PROCEED;
+}
+
+// static
+std::unique_ptr<NavigationThrottle>
+DataUrlNavigationThrottle::CreateThrottleForNavigation(
+    NavigationHandle* navigation_handle) {
+  if (IsBrowserSideNavigationEnabled())
+    return base::WrapUnique(new DataUrlNavigationThrottle(navigation_handle));
+  return nullptr;
+}
+
+}  // namespace content