Sanitize referrers before we create them

chrome/renderer/prerender/prerender_dispatcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/prerender/prerender_dispatcher.h"
 
 #include "base/logging.h"
 #include "chrome/common/prerender_messages.h"
 #include "chrome/common/prerender_types.h"
 #include "chrome/renderer/prerender/prerender_extra_data.h"
@@ skipping 122 matching lines @@
   }
 
   prerenders_[extra_data.prerender_id()] = prerender;
 
   PrerenderAttributes attributes;
   attributes.url = GURL(prerender.url());
   attributes.rel_types = prerender.relTypes();
 
   content::RenderThread::Get()->Send(new PrerenderHostMsg_AddLinkRelPrerender(
       extra_data.prerender_id(), attributes,
-      content::Referrer(GURL(prerender.referrer()),
-                        prerender.referrerPolicy()),
+      content::Referrer::SanitizeForRequest(
+          GURL(prerender.url()), content::Referrer(GURL(prerender.referrer()),
+                                                   prerender.referrerPolicy())),
       extra_data.size(), extra_data.render_view_route_id()));
 }
 
 void PrerenderDispatcher::cancel(const WebPrerender& prerender) {
   const PrerenderExtraData& extra_data =
       PrerenderExtraData::FromPrerender(prerender);
   content::RenderThread::Get()->Send(
       new PrerenderHostMsg_CancelLinkRelPrerender(extra_data.prerender_id()));
   // The browser will not send an OnPrerenderStop (the prerender may have even
   // been canceled before it was started), so release it to avoid a
   // leak. Moreover, if it did, the PrerenderClient in Blink will have been
   // detached already.
    prerenders_.erase(extra_data.prerender_id());
 }
 
 void PrerenderDispatcher::abandon(const WebPrerender& prerender) {
   const PrerenderExtraData& extra_data =
       PrerenderExtraData::FromPrerender(prerender);
   content::RenderThread::Get()->Send(
       new PrerenderHostMsg_AbandonLinkRelPrerender(extra_data.prerender_id()));
   // The browser will not send an OnPrerenderStop (the prerender may have even
   // been canceled before it was started), so release it to avoid a
   // leak. Moreover, if it did, the PrerenderClient in Blink will have been
   // detached already.
   prerenders_.erase(extra_data.prerender_id());
 }
 
 }  // namespace prerender