Sanitize referrers before we create them

chrome/browser/extensions/webstore_inline_installer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/webstore_inline_installer.h"
 
 #include "base/strings/stringprintf.h"
 #include "chrome/browser/profiles/profile.h"
 #include "content/public/browser/web_contents.h"
 
@@ skipping 124 matching lines @@
                                     &inline_install_not_supported)) {
     *error = kInvalidWebstoreResponseError;
     return false;
   }
   if (inline_install_not_supported) {
     std::string redirect_url;
     if (!webstore_data.GetString(kRedirectUrlKey, &redirect_url)) {
       *error = kInvalidWebstoreResponseError;
       return false;
     }
-    web_contents()->OpenURL(
-        content::OpenURLParams(
+    web_contents()->OpenURL(content::OpenURLParams(
+        GURL(redirect_url),
+        content::Referrer::SanitizeForRequest(
             GURL(redirect_url),
             content::Referrer(web_contents()->GetURL(),
-                              blink::WebReferrerPolicyDefault),
-            NEW_FOREGROUND_TAB, ui::PAGE_TRANSITION_AUTO_BOOKMARK, false));
+                              blink::WebReferrerPolicyDefault)),
+        NEW_FOREGROUND_TAB, ui::PAGE_TRANSITION_AUTO_BOOKMARK, false));
     *error = kInlineInstallSupportedError;
     return false;
   }
 
   *error = "";
   return true;
 }
 
 bool WebstoreInlineInstaller::CheckRequestorPermitted(
     const base::DictionaryValue& webstore_data,
@@ skipping 53 matching lines @@
     DLOG(WARNING) << "Could not parse " << verified_site_pattern_spec <<
         " as URL pattern " << parse_result;
     return false;
   }
   verified_site_pattern.SetScheme("*");
 
   return verified_site_pattern.MatchesURL(requestor_url);
 }
 
 }  // namespace extensions