Show error for invalid url in chrome.app.window.create()

chrome/browser/extensions/api/app_window/app_window_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/app_window/app_window_api.h"
 
 #include "apps/app_window.h"
 #include "apps/app_window_contents.h"
 #include "apps/app_window_registry.h"
 #include "apps/apps_client.h"
@@ skipping 140 matching lines @@
 
   GURL url = GetExtension()->GetResourceURL(params->url);
   // Allow absolute URLs for component apps, otherwise prepend the extension
   // path.
   if (GetExtension()->location() == extensions::Manifest::COMPONENT) {
     GURL absolute = GURL(params->url);
     if (absolute.has_scheme())
       url = absolute;
   }
 
+  // Show warning when url passed isn't local
+  if (GURL(params->url).has_scheme()) {
+    WriteToConsole(content::CONSOLE_MESSAGE_LEVEL_WARNING,

[benwells, 2014/06/18 03:22:17]

Errors from APIs are generally communicated via chrome.runtime.lastError, which
API users should be checking for. E.g. see below where the id is too long, which
is a similar case.

[Nikhil, 2014/06/18 08:52:39]

Done.

+                   "Url passed as parameter to chrome.app.window.create() "
+                   "should be local for security reasons.");
+  }
+
   // TODO(jeremya): figure out a way to pass the opening WebContents through to
   // AppWindow::Create so we can set the opener at create time rather than
   // with a hack in AppWindowCustomBindings::GetView().
   AppWindow::CreateParams create_params;
   app_window::CreateWindowOptions* options = params->options.get();
   if (options) {
     if (options->id.get()) {
       // TODO(mek): use URL if no id specified?
       // Limit length of id to 256 characters.
       if (options->id->length() > 256) {
@@ skipping 312 matching lines @@
 
   if (options.frame->as_frame_options->inactive_color.get()) {
     error_ = app_window_constants::kInactiveColorWithoutColor;
     return false;
   }
 
   return true;
 }
 
 }  // namespace extensions