Ensure the renderer doesn't specify base_url_for_data_url in the BeginNavigation IPC.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 2bdb04d78b4352fa6e12420164ff14aa43964385..3cd8dc1905114e982c7cbb7e2c58d09cf272959c 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -2185,6 +2185,11 @@ void RenderFrameHostImpl::OnBeginNavigation(
 
   CommonNavigationParams validated_params = common_params;
   GetProcess()->FilterURL(false, &validated_params.url);
+  if (!validated_params.base_url_for_data_url.is_empty()) {
+    // Kills the process. http://crbug.com/726142
+    bad_message::ReceivedBadMessage(
+        GetProcess(), bad_message::RFH_BASE_URL_FOR_DATA_URL_SPECIFIED);

[Charlie Reis, 2017/05/30 20:41:48]

This needs a return statement, or we'll continue with the request anyway.

+  }
 
   BeginNavigationParams validated_begin_params = begin_params;
   GetProcess()->FilterURL(true, &validated_begin_params.searchable_form_url);