Sanitize referrer in context menus.

content/public/common/referrer.h

Index: content/public/common/referrer.h
diff --git a/content/public/common/referrer.h b/content/public/common/referrer.h
index b10bfd6c28e6cd96f6e44a5a2070904693fae979..122c5ead79096c2fb148d11206e8071f48671074 100644
--- a/content/public/common/referrer.h
+++ b/content/public/common/referrer.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_COMMON_REFERRER_H_
 #define CONTENT_PUBLIC_COMMON_REFERRER_H_
 
+#include "base/logging.h"
 #include "content/common/content_export.h"
 #include "third_party/WebKit/public/platform/WebReferrerPolicy.h"
 #include "url/gurl.h"
@@ -23,6 +24,38 @@ struct CONTENT_EXPORT Referrer {
 
   GURL url;
   blink::WebReferrerPolicy policy;
+
+  static Referrer SanitizeForRequest(const GURL& request,
+                                     const Referrer& referrer) {
+    Referrer sanitized_referrer(referrer.url.GetAsReferrer(), referrer.policy);
+
+    if (!request.SchemeIsHTTPOrHTTPS() ||
+        !sanitized_referrer.url.SchemeIsHTTPOrHTTPS()) {
+      sanitized_referrer.url = GURL();
+      return sanitized_referrer;
+    }
+
+    switch (sanitized_referrer.policy) {
+      case blink::WebReferrerPolicyDefault:
+        if (sanitized_referrer.url.SchemeIsSecure() &&
+            !request.SchemeIsSecure()) {
+          sanitized_referrer.url = GURL();
+        }
+        break;
+      case blink::WebReferrerPolicyAlways:
+        break;
+      case blink::WebReferrerPolicyNever:
+        sanitized_referrer.url = GURL();
+        break;
+      case blink::WebReferrerPolicyOrigin:
+        sanitized_referrer.url = sanitized_referrer.url.GetOrigin();
+        break;
+      default:
+        NOTREACHED();
+        break;
+    }
+    return sanitized_referrer;
+  }
 };
 
 }  // namespace content