Block renderer-initiated main frame navigations to data URLs

content/browser/frame_host/data_url_navigation_throttle.cc

Index: content/browser/frame_host/data_url_navigation_throttle.cc
diff --git a/content/browser/frame_host/data_url_navigation_throttle.cc b/content/browser/frame_host/data_url_navigation_throttle.cc
new file mode 100644
index 0000000000000000000000000000000000000000..b2a958a4ef80ac3e307aa783593b5690358186a2
--- /dev/null
+++ b/content/browser/frame_host/data_url_navigation_throttle.cc
@@ -0,0 +1,62 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/frame_host/data_url_navigation_throttle.h"
+
+#include "base/feature_list.h"
+#include "base/memory/ptr_util.h"
+#include "base/strings/stringprintf.h"
+#include "content/browser/frame_host/frame_tree.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/common/console_message_level.h"
+#include "content/public/common/content_features.h"
+#include "url/url_constants.h"
+
+namespace content {
+
+namespace {
+const char kConsoleError[] =
+    "Not allowed to navigate top frame to data URL: %s";
+}
+
+DataUrlNavigationThrottle::DataUrlNavigationThrottle(
+    NavigationHandle* navigation_handle)
+    : NavigationThrottle(navigation_handle) {}
+
+DataUrlNavigationThrottle::~DataUrlNavigationThrottle() {}
+
+NavigationThrottle::ThrottleCheckResult
+DataUrlNavigationThrottle::WillProcessResponse() {
+  NavigationHandleImpl* handle =
+      static_cast<NavigationHandleImpl*>(navigation_handle());
+  if (handle->is_download())
+    return PROCEED;
+
+  RenderFrameHost* top_frame =
+      handle->frame_tree_node()->frame_tree()->root()->current_frame_host();
+  top_frame->AddMessageToConsole(
+      CONSOLE_MESSAGE_LEVEL_ERROR,
+      base::StringPrintf(kConsoleError, handle->GetURL().spec().c_str()));
+  return CANCEL;
+}
+
+// static
+std::unique_ptr<NavigationThrottle>
+DataUrlNavigationThrottle::CreateThrottleForNavigation(
+    NavigationHandle* navigation_handle) {
+  if (navigation_handle->GetURL().SchemeIs(url::kDataScheme) &&
+      navigation_handle->IsInMainFrame() &&
+      navigation_handle->IsRendererInitiated() &&
+      !navigation_handle->IsSameDocument() &&
+      !base::FeatureList::IsEnabled(
+          features::kAllowContentInitiatedDataUrlNavigations)) {
+    return base::MakeUnique<DataUrlNavigationThrottle>(navigation_handle);
+  }
+  return nullptr;
+}
+
+}  // namespace content