Show error for invalid url in chrome.app.window.create()

chrome/browser/extensions/api/app_window/app_window_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/app_window/app_window_api.h"
 
 #include "apps/app_window.h"
 #include "apps/app_window_contents.h"
 #include "apps/app_window_registry.h"
 #include "apps/apps_client.h"
@@ skipping 34 matching lines @@
     "The window id can not be more than 256 characters long.";
 const char kInvalidColorSpecification[] =
     "The color specification could not be parsed.";
 const char kColorWithFrameNone[] = "Windows with no frame cannot have a color.";
 const char kInactiveColorWithoutColor[] =
     "frame.inactiveColor must be used with frame.color.";
 const char kConflictingBoundsOptions[] =
     "The $1 property cannot be specified for both inner and outer bounds.";
 const char kAlwaysOnTopPermission[] =
     "The \"app.window.alwaysOnTop\" permission is required.";
+const char kInvalidUrlParameter[] =
+    "Url passed should be local for security reasons.";

[benwells, 2014/06/19 08:40:32]

Nit: please rephrase as "The URL used for window creation must ..."

[Nikhil, 2014/06/19 08:55:58]

Done.

 }  // namespace app_window_constants
 
 const char kNoneFrameOption[] = "none";
   // TODO(benwells): Remove HTML titlebar injection.
 const char kHtmlFrameOption[] = "experimental-html";
 
 namespace {
 
 // Opens an inspector window and delays the response to the
 // AppWindowCreateFunction until the DevToolsWindow has finished loading, and is
@@ skipping 80 matching lines @@
   // Don't create app window if the system is shutting down.
   if (extensions::ExtensionsBrowserClient::Get()->IsShuttingDown())
     return false;
 
   scoped_ptr<Create::Params> params(Create::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params.get());
 
   GURL url = GetExtension()->GetResourceURL(params->url);
   // Allow absolute URLs for component apps, otherwise prepend the extension
   // path.
-  if (GetExtension()->location() == extensions::Manifest::COMPONENT) {
-    GURL absolute = GURL(params->url);
-    if (absolute.has_scheme())
+  GURL absolute = GURL(params->url);
+  if (absolute.has_scheme()) {
+    if (GetExtension()->location() == extensions::Manifest::COMPONENT) {
       url = absolute;
+    } else {
+      // Show error when url passed isn't local.
+      error_ = app_window_constants::kInvalidUrlParameter;
+      return false;
+    }
   }
 
   // TODO(jeremya): figure out a way to pass the opening WebContents through to
   // AppWindow::Create so we can set the opener at create time rather than
   // with a hack in AppWindowCustomBindings::GetView().
   AppWindow::CreateParams create_params;
   app_window::CreateWindowOptions* options = params->options.get();
   if (options) {
     if (options->id.get()) {
       // TODO(mek): use URL if no id specified?
@@ skipping 314 matching lines @@
 
   if (options.frame->as_frame_options->inactive_color.get()) {
     error_ = app_window_constants::kInactiveColorWithoutColor;
     return false;
   }
 
   return true;
 }
 
 }  // namespace extensions