DevTools: Display a warning when trying to open untrusted frontend

chrome/browser/ui/webui/devtools_ui.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/devtools_ui.h"
 
 #include <string>
 
 #include "base/memory/ref_counted_memory.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 22 matching lines @@
       .path().substr(1);
 }
 
 const char kRemoteFrontendDomain[] = "chrome-devtools-frontend.appspot.com";
 const char kRemoteFrontendBase[] =
     "https://chrome-devtools-frontend.appspot.com/";
 const char kHttpNotFound[] = "HTTP/1.1 404 Not Found\n\n";
 
 #if defined(DEBUG_DEVTOOLS)
 // Local frontend url provided by InspectUI.
-const char kLocalFrontendURL[] =
+const char kFallbackFrontendURL[] =
     "chrome-devtools://devtools/bundled/devtools.html";
+#else
+// URL causing the DevTools window to display a plain text warning.
+const char kFallbackFrontendURL[] =
+    "data:text/plain,Cannot load DevTools frontend from an untrusted origin";
 #endif  // defined(DEBUG_DEVTOOLS)
 
+
 class FetchRequest : public net::URLFetcherDelegate {
  public:
   FetchRequest(net::URLRequestContextGetter* request_context,
                const GURL& url,
                const content::URLDataSource::GotDataCallback& callback)
       : callback_(callback) {
     if (!url.is_valid()) {
       OnURLFetchComplete(NULL);
       return;
     }
@@ skipping 126 matching lines @@
   scoped_refptr<net::URLRequestContextGetter> request_context_;
 
   DISALLOW_COPY_AND_ASSIGN(DevToolsDataSource);
 };
 
 }  // namespace
 
 // static
 GURL DevToolsUI::GetProxyURL(const std::string& frontend_url) {
   GURL url(frontend_url);
-#if defined(DEBUG_DEVTOOLS)
   if (!url.is_valid() || url.host() != kRemoteFrontendDomain) {
-    return GURL(kLocalFrontendURL);
+    return GURL(kFallbackFrontendURL);
   }
-#endif  // defined(DEBUG_DEVTOOLS)
-  CHECK(url.is_valid());
-  CHECK_EQ(url.host(), kRemoteFrontendDomain);
   return GURL(base::StringPrintf("%s://%s/%s/%s",
               chrome::kChromeDevToolsScheme,
               chrome::kChromeUIDevToolsHost,
               chrome::kChromeUIDevToolsRemotePath,
               url.path().substr(1).c_str()));
 }
 
 DevToolsUI::DevToolsUI(content::WebUI* web_ui) : WebUIController(web_ui) {
   web_ui->SetBindings(0);
   Profile* profile = Profile::FromWebUI(web_ui);
   content::URLDataSource::Add(
       profile,
       new DevToolsDataSource(profile->GetRequestContext()));
 }