RenderFrameProxyHost::OnOpenURL needs to validate resource request body.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 05a6a540fa19a178d617395ea468ce36211b4910..a3606b43ea3bcda831145bee7b10408ff8ba7d1d 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -57,6 +57,7 @@
 #include "content/browser/renderer_host/render_widget_host_delegate.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
+#include "content/browser/resource_request_body_browser_utils.h"
 #include "content/browser/shared_worker/shared_worker_service_impl.h"
 #include "content/browser/websockets/websocket_manager.h"
 #include "content/browser/webui/url_data_manager_backend.h"
@@ -1221,6 +1222,11 @@ void RenderFrameHostImpl::OnFrameFocused() {
 void RenderFrameHostImpl::OnOpenURL(const FrameHostMsg_OpenURL_Params& params) {
   GURL validated_url(params.url);
   GetProcess()->FilterURL(false, &validated_url);
+  if (!CanReadRequestBody(GetSiteInstance(), params.resource_request_body)) {
+    bad_message::ReceivedBadMessage(GetProcess(),
+                                    bad_message::RFH_ILLEGAL_UPLOAD_PARAMS);

[Łukasz Anforowicz, 2017/05/25 19:56:01]

This reuses the bad_message flavour added yesterday for OnBeginNavigation.  I
think the reuse should be fine?

[alexmos, 2017/05/25 23:44:06]

I think so.  If we ever get a problem with a lot of these kills, we'll still get
DWOC reports from ShutdownForBadMessage, which we can use to tell which variety
is triggering them.

+    return;
+  }
 
   if (params.is_history_navigation_in_new_child) {
     // Try to find a FrameNavigationEntry that matches this frame instead, based