Disable web payments API on blob: and data: schemes.

chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentRequestImpl.java

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package org.chromium.chrome.browser.payments;
 
 import android.app.Activity;
 import android.content.Context;
 import android.content.Intent;
 import android.graphics.Bitmap;
@@ skipping 406 matching lines @@
             disconnectFromClientWithDebugMessage("Not in a secure context");
             return;
         }
 
         mRequestShipping = options != null && options.requestShipping;
         mRequestPayerName = options != null && options.requestPayerName;
         mRequestPayerPhone = options != null && options.requestPayerPhone;
         mRequestPayerEmail = options != null && options.requestPayerEmail;
         mShippingType = options == null ? PaymentShippingType.SHIPPING : options.shippingType;
 
+        if (!OriginSecurityChecker.isSchemeCryptographic(mWebContents.getLastCommittedUrl())
+                && !OriginSecurityChecker.isOriginLocalhostOrFile(
+                           mWebContents.getLastCommittedUrl())) {
+            Log.d(TAG, "Only localhost, file://, and cryptographic scheme origins allowed");
+            // Don't show any UI. Resolve .canMakePayment() with "false". Reject .show() with
+            // "NotSupportedError".
+            onAllPaymentAppsCreated();
+            return;
+        }
+
         PaymentRequestMetrics.recordRequestedInformationHistogram(
                 mRequestPayerEmail, mRequestPayerPhone, mRequestShipping, mRequestPayerName);
 
         if (OriginSecurityChecker.isSchemeCryptographic(mWebContents.getLastCommittedUrl())
                 && !SslValidityChecker.isSslCertificateValid(mWebContents)) {
             Log.d(TAG, "SSL certificate is not valid");
             // Don't show any UI. Resolve .canMakePayment() with "false". Reject .show() with
             // "NotSupportedError".
             onAllPaymentAppsCreated();
             return;
@@ skipping 1365 matching lines @@
 
     /**
      * The frecency score is calculated according to use count and last use date. The formula is
      * the same as the one used in GetFrecencyScore in autofill_data_model.cc.
      */
     private static final double getFrecencyScore(int count, long date) {
         long currentTime = System.currentTimeMillis();
         return -Math.log((currentTime - date) / (24 * 60 * 60 * 1000) + 2) / Math.log(count + 2);
     }
 }