Block data URL navigations with RenderFrameImpl::DecidePolicyForNavigation

chrome/test/data/extensions/platform_apps/web_view/shim/main.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var util = {};
 var embedder = {};
 embedder.baseGuestURL = '';
 embedder.emptyGuestURL = '';
 embedder.windowOpenGuestURL = '';
 embedder.noReferrerGuestURL = '';
@@ skipping 412 matching lines @@
   webview.addEventListener('loadabort', function(e) {
     embedder.test.fail();
   });
   webview.addEventListener('loadstop', function(e) {
     embedder.test.succeed();
   });
   webview.setAttribute('src', 'guest_with_inline_script.html');
   document.body.appendChild(webview);
 }
 
+// This test verifies that guests are blocked from navigating the webview to a
+// data URL.
+function testContentInitiatedNavigationToDataUrlBlocked() {
+  var navUrl = "data:text/html,foo";
+  var webview = document.createElement('webview');
+  webview.addEventListener('consolemessage', function(e) {
+    if (e.message.startsWith(
+        'Not allowed to top-level navigate to resource:')) {
+      embedder.test.succeed();
+    }
+  });
+  webview.addEventListener('loadstop', function(e) {
+    if (webview.getAttribute('src') == navUrl) {
+      embedder.test.fail();
+    }
+  });
+  webview.setAttribute('src',
+      'data:text/html,<script>window.location.href = "' + navUrl +
+      '";</scr' + 'ipt>');
+  document.body.appendChild(webview);
+}
+
 // Tests that a <webview> that starts with "display: none" style loads
 // properly.
 function testDisplayNoneWebviewLoad() {
   var webview = document.createElement('webview');
   var visible = false;
   webview.style.display = 'none';
   // foobar is a privileged partition according to the manifest file.
   webview.partition = 'foobar';
   webview.addEventListener('loadabort', function(e) {
     embedder.test.fail();
@@ skipping 2602 matching lines @@
 embedder.test.testList = {
   'testAllowTransparencyAttribute': testAllowTransparencyAttribute,
   'testAutosizeHeight': testAutosizeHeight,
   'testAutosizeAfterNavigation': testAutosizeAfterNavigation,
   'testAutosizeBeforeNavigation': testAutosizeBeforeNavigation,
   'testAutosizeRemoveAttributes': testAutosizeRemoveAttributes,
   'testAutosizeWithPartialAttributes': testAutosizeWithPartialAttributes,
   'testAPIMethodExistence': testAPIMethodExistence,
   'testChromeExtensionURL': testChromeExtensionURL,
   'testChromeExtensionRelativePath': testChromeExtensionRelativePath,
+  'testContentInitiatedNavigationToDataUrlBlocked':
+      testContentInitiatedNavigationToDataUrlBlocked,
   'testDisplayNoneWebviewLoad': testDisplayNoneWebviewLoad,
   'testDisplayNoneWebviewRemoveChild': testDisplayNoneWebviewRemoveChild,
   'testInlineScriptFromAccessibleResources':
       testInlineScriptFromAccessibleResources,
   'testInvalidChromeExtensionURL': testInvalidChromeExtensionURL,
   'testWebRequestAPIExistence': testWebRequestAPIExistence,
   'testWebRequestAPIAddListener': testWebRequestAPIAddListener,
   'testEventName': testEventName,
   'testOnEventProperties': testOnEventProperties,
   'testLoadProgressEvent': testLoadProgressEvent,
@@ skipping 93 matching lines @@
        testRendererNavigationRedirectWhileUnattached,
   'testBlobURL': testBlobURL
 };
 
 onload = function() {
   chrome.test.getConfig(function(config) {
     embedder.setUp_(config);
     chrome.test.sendMessage("Launched");
   });
 };