Sanitize referrers before we create them

content/browser/service_worker/service_worker_version.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/service_worker/service_worker_version.h"
 
 #include "base/command_line.h"
 #include "base/memory/ref_counted.h"
 #include "base/stl_util.h"
 #include "base/strings/string16.h"
@@ skipping 226 matching lines @@
   RenderProcessHost* render_process_host =
       RenderProcessHost::FromID(process_id);
   if (render_process_host->IsIsolatedGuest()) {
     BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
                             base::Bind(callback,
                                        ChildProcessHost::kInvalidUniqueID,
                                        MSG_ROUTING_NONE));
     return;
   }
 
-  OpenURLParams params(url,
-                       Referrer(script_url, blink::WebReferrerPolicyDefault),
-                       NEW_FOREGROUND_TAB,
-                       ui::PAGE_TRANSITION_AUTO_TOPLEVEL,
-                       true /* is_renderer_initiated */);
+  OpenURLParams params(
+      url, Referrer::SanitizeForRequest(
+               url, Referrer(script_url, blink::WebReferrerPolicyDefault)),
+      NEW_FOREGROUND_TAB, ui::PAGE_TRANSITION_AUTO_TOPLEVEL,
+      true /* is_renderer_initiated */);
 
   WebContents* web_contents =
       GetContentClient()->browser()->OpenURL(browser_context, params);
   DCHECK(web_contents);
 
   new WindowOpenedObserver(web_contents, callback);
 }
 
 void KillEmbeddedWorkerProcess(int process_id, ResultCode code) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ skipping 1155 matching lines @@
     int request_id) {
   callbacks->Remove(request_id);
   if (is_doomed_) {
     // The stop should be already scheduled, but try to stop immediately, in
     // order to release worker resources soon.
     StopWorkerIfIdle();
   }
 }
 
 }  // namespace content