Sanitize referrer from Intents

content/browser/frame_host/navigation_request.cc

Index: content/browser/frame_host/navigation_request.cc
diff --git a/content/browser/frame_host/navigation_request.cc b/content/browser/frame_host/navigation_request.cc
index 6ba54ceff8dbae7e6297620e53ec0825cca1fb4d..93b8de84a30e5759f3d1a2d8f6806fa9642a0a9a 100644
--- a/content/browser/frame_host/navigation_request.cc
+++ b/content/browser/frame_host/navigation_request.cc
@@ -354,6 +354,10 @@ void NavigationRequest::BeginNavigation() {
 
   if (ShouldMakeNetworkRequestForURL(common_params_.url) &&
       !navigation_handle_->IsSameDocument()) {
+    // The referrer from the Intents needs to be sanitized.
+    common_params_.referrer = Referrer::SanitizeForRequest(
+        common_params_.url, common_params_.referrer);
+
     // It's safe to use base::Unretained because this NavigationRequest owns
     // the NavigationHandle where the callback will be stored.
     // TODO(clamy): pass the real value for |is_external_protocol| if needed.
@@ -361,10 +365,8 @@ void NavigationRequest::BeginNavigation() {
     // boolean.
     navigation_handle_->WillStartRequest(
         common_params_.method, common_params_.post_data,
-        Referrer::SanitizeForRequest(common_params_.url,
-                                     common_params_.referrer),
-        begin_params_.has_user_gesture, common_params_.transition, false,
-        begin_params_.request_context_type,
+        common_params_.referrer, begin_params_.has_user_gesture,
+        common_params_.transition, false, begin_params_.request_context_type,
         begin_params_.mixed_content_context_type,
         base::Bind(&NavigationRequest::OnStartChecksComplete,
                    base::Unretained(this)));