Do not rewrite about urls to chrome:// for cetain renderer-initated loads

ios/web/navigation/crw_session_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/navigation/crw_session_controller.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <utility>
@@ skipping 641 matching lines @@
     if (transientRewriters) {
       urlWasRewritten = web::BrowserURLRewriter::RewriteURLWithWriters(
           &loaded_url, _browserState, *transientRewriters.get());
     }
   }
   if (!urlWasRewritten) {
     web::BrowserURLRewriter::GetInstance()->RewriteURLIfNecessary(
         &loaded_url, _browserState);
   }
 
+  if (initiationType == web::NavigationInitiationType::RENDERER_INITIATED &&
+      loaded_url != url && web::GetWebClient()->IsAppSpecificURL(loaded_url)) {
+    bool lastCommittedURLIsAppSpecific =
+        self.lastCommittedItem &&
+        web::GetWebClient()->IsAppSpecificURL(self.lastCommittedItem->GetURL());
+    if (!lastCommittedURLIsAppSpecific) {
+      // The URL should not be changed to app-specific URL if the load was
+      // renderer-initiated requested by non app-specific URL. Pages with
+      // app-specific urls have elevated previledges and should not be allowed
+      // to open app-specific URLs.
+      loaded_url = url;
+    }
+  }
+
   std::unique_ptr<web::NavigationItemImpl> item(new web::NavigationItemImpl());
   item->SetOriginalRequestURL(loaded_url);
   item->SetURL(loaded_url);
   item->SetReferrer(referrer);
   item->SetTransitionType(transition);
   item->SetNavigationInitiationType(initiationType);
   if (web::GetWebClient()->IsAppSpecificURL(loaded_url))
     item->SetUserAgentType(web::UserAgentType::NONE);
   return item;
 }
 
 - (BOOL)isRedirectTransitionForItemAtIndex:(size_t)index {
   DCHECK_LT(index, self.items.size());
   ui::PageTransition transition = self.items[index]->GetTransitionType();
   return (transition & ui::PAGE_TRANSITION_IS_REDIRECT_MASK) ? YES : NO;
 }
 
 @end