Chrome-side changes to use registerURLSchemeNoAccess.

chrome/renderer/render_thread.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/render_thread.h"
 
 #include <algorithm>
 #include <vector>
 
 #include "base/command_line.h"
@@ skipping 234 matching lines @@
 }
 
 void RenderThread::EnsureWebKitInitialized() {
   if (webkit_client_.get())
     return;
 
   v8::V8::SetCounterFunction(StatsTable::FindLocation);
 
   webkit_client_.reset(new RendererWebKitClientImpl);
   WebKit::initialize(webkit_client_.get());
-  WebKit::registerURLSchemeAsLocal(ASCIIToUTF16(chrome::kChromeUIScheme));
+
+  // chrome-ui pages should not be accessible by normal content, and should
+  // also be unable to script anything but themselves (to help limit the damage
+  // that a corrupt chrome-ui page could cause).
+  WebKit::WebString chrome_ui_scheme(ASCIIToUTF16(chrome::kChromeUIScheme));
+  WebKit::registerURLSchemeAsLocal(chrome_ui_scheme);
+  WebKit::registerURLSchemeAsNoAccess(chrome_ui_scheme);
 
   WebKit::registerExtension(extensions_v8::GearsExtension::Get());
   WebKit::registerExtension(extensions_v8::IntervalExtension::Get());
 
   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
   if (command_line.HasSwitch(switches::kPlaybackMode) ||
       command_line.HasSwitch(switches::kRecordMode)) {
     WebKit::registerExtension(extensions_v8::PlaybackExtension::Get());
   }
 }