Sanitize referrer in context menus.

components/sessions/serialized_navigation_entry.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/sessions/serialized_navigation_entry.h"
 
 #include "base/pickle.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/public/browser/favicon_status.h"
 #include "content/public/browser/navigation_controller.h"
@@ skipping 494 matching lines @@
   for (std::vector<SerializedNavigationEntry>::const_iterator
        it = navigations.begin(); it != navigations.end(); ++it) {
     entries.push_back(
         it->ToNavigationEntry(page_id, browser_context).release());
     ++page_id;
   }
   return entries;
 }
 
 void SerializedNavigationEntry::Sanitize() {
-  // Store original referrer so we can later see whether it was actually
-  // changed during sanitization, and we need to strip the referrer from the
-  // page state as well.
-  content::Referrer old_referrer = referrer_;
+  content::Referrer new_referrer =
+      content::Referrer::SanitizeForRequest(virtual_url_, referrer_);
 
-  if (!referrer_.url.SchemeIsHTTPOrHTTPS())
-    referrer_ = content::Referrer();
-  switch (referrer_.policy) {
-    case blink::WebReferrerPolicyNever:
-      referrer_.url = GURL();
-      break;
-    case blink::WebReferrerPolicyAlways:
-      break;
-    case blink::WebReferrerPolicyOrigin:
-      referrer_.url = referrer_.url.GetWithEmptyPath();
-      break;
-    case blink::WebReferrerPolicyDefault:
-      // Fall through.
-    default:
-      referrer_.policy = blink::WebReferrerPolicyDefault;
-      if (referrer_.url.SchemeIsSecure() && !virtual_url_.SchemeIsSecure())
-        referrer_.url = GURL();
-  }
-
-  if (referrer_.url != old_referrer.url ||
-      referrer_.policy != old_referrer.policy) {
+  // No need to compare the policy, as it doesn't change during
+  // sanitization. If there has been a change, the referrer needs to be
+  // stripped from the page state as well.
+  if (referrer_.url != new_referrer.url) {
     referrer_ = content::Referrer();

[nasko, 2014/08/05 14:27:58]

Should this be totally cleared or should the sanitized version be kept?

[jochen (gone - plz use gerrit), 2014/08/05 15:16:56]

here totally clearing is fine.

     page_state_ = page_state_.RemoveReferrer();
   }
 }
 
 }  // namespace sessions