RenderFrameProxyHost::OnOpenURL needs to validate resource request body.

content/browser/bad_message.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_BAD_MESSAGE_H_
 #define CONTENT_BROWSER_BAD_MESSAGE_H_
 
 namespace content {
 class BrowserMessageFilter;
 class RenderProcessHost;
@@ skipping 174 matching lines @@
   BDH_INVALID_DESCRIPTOR_ID = 161,
   RWH_INVALID_BEGIN_FRAME_ACK_DID_NOT_SWAP = 162,
   RWH_INVALID_BEGIN_FRAME_ACK_COMPOSITOR_FRAME = 163,
   BFSI_INVALID_TAG = 164,
   BFSI_INVALID_REQUESTS = 165,
   BFSI_INVALID_TITLE = 166,
   RWH_INVALID_FRAME_TOKEN = 167,
   RWH_BAD_FRAME_SINK_REQUEST = 168,
   RWH_SURFACE_INVARIANTS_VIOLATION = 169,
   RFH_ILLEGAL_UPLOAD_PARAMS = 170,
+  RFPH_ILLEGAL_UPLOAD_PARAMS = 171,
 
   // Please add new elements here. The naming convention is abbreviated class
   // name (e.g. RenderFrameHost becomes RFH) plus a unique description of the
   // reason. After making changes, you MUST update histograms.xml by running:
   // "python tools/metrics/histograms/update_bad_message_reasons.py"
   BAD_MESSAGE_MAX
 };
 
 // Called when the browser receives a bad IPC message from a renderer process on
 // the UI thread. Logs the event, records a histogram metric for the |reason|,
 // and terminates the process for |host|.
 void ReceivedBadMessage(RenderProcessHost* host, BadMessageReason reason);
 
 // Equivalent to the above, but callable from any thread.
 void ReceivedBadMessage(int render_process_id, BadMessageReason reason);
 
 // Called when a browser message filter receives a bad IPC message from a
 // renderer or other child process. Logs the event, records a histogram metric
 // for the |reason|, and terminates the process for |filter|.
 void ReceivedBadMessage(BrowserMessageFilter* filter, BadMessageReason reason);
 
 }  // namespace bad_message
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_BAD_MESSAGE_H_