cros: Restrict gaiaURL to be http and https only.

chrome/browser/resources/gaia_auth/main.js

Index: chrome/browser/resources/gaia_auth/main.js
diff --git a/chrome/browser/resources/gaia_auth/main.js b/chrome/browser/resources/gaia_auth/main.js
index cf0d43d6b5a091272d624772b3c34e31d3c447a4..914bed5748e937bab677567b467362107d3c81fd 100644
--- a/chrome/browser/resources/gaia_auth/main.js
+++ b/chrome/browser/resources/gaia_auth/main.js
@@ -82,6 +82,14 @@ Authenticator.prototype = {
     var params = getUrlSearchParams(location.search);
     this.parentPage_ = params.parentPage || this.PARENT_PAGE;
     this.gaiaUrl_ = params.gaiaUrl || this.GAIA_URL;
+
+    // Sanitize Gaia url before continuing.
+    var scheme = extractProtocol(this.gaiaUrl_);
+    if (scheme != 'https:' && scheme != 'http:') {
+      console.error('Bad Gaia URL, url=' + this.gaiaURL_);
+      return;
+    }
+
     this.gaiaPath_ = params.gaiaPath || this.GAIA_PAGE_PATH;
     this.inputLang_ = params.hl;
     this.inputEmail_ = params.email;