Move URL fixup to a preliminary phase that doesn't affect virtual URLs.

chrome/browser/browser_about_handler.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/browser_about_handler.h"
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "base/strings/string_util.h"
 #include "chrome/browser/lifetime/application_lifetime.h"
 #include "chrome/browser/ui/browser_dialogs.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/url_constants.h"
 #include "components/url_fixer/url_fixer.h"
 
+bool FixupBrowserAboutURL(GURL* url,
+                          content::BrowserContext* browser_context) {
+  // Ensure that any cleanup done by FixupURL happens before the rewriting
+  // phase that determines the virtual URL, by including it in an initial
+  // URLHandler.  This prevents minor changes from producing a virtual URL,
+  // which could lead to a URL spoof.
+  *url = url_fixer::FixupURL(url->possibly_invalid_spec(), std::string());
+  return true;
+}
+
 bool WillHandleBrowserAboutURL(GURL* url,
                                content::BrowserContext* browser_context) {
   // TODO(msw): Eliminate "about:*" constants and literals from code and tests,
   //            then hopefully we can remove this forced fixup.
   *url = url_fixer::FixupURL(url->possibly_invalid_spec(), std::string());

[msw, 2015/02/18 22:01:23]

Should this call FixupBrowserAboutURL instead?

[Charlie Reis, 2015/02/18 22:16:17]

Good idea.  Done.

 
   // Check that about: URLs are fixed up to chrome: by url_fixer::FixupURL.
   DCHECK((*url == GURL(url::kAboutBlankURL)) ||
          !url->SchemeIs(url::kAboutScheme));
 
   // Only handle chrome://foo/, url_fixer::FixupURL translates about:foo.
   if (!url->SchemeIs(content::kChromeUIScheme))
     return false;
 
   std::string host(url->host());
@@ skipping 66 matching lines @@
         base::Bind(&chrome::AttemptRestart));
     return true;
   } else if (LowerCaseEqualsASCII(spec, chrome::kChromeUIQuitURL)) {
     base::MessageLoop::current()->PostTask(FROM_HERE,
         base::Bind(&chrome::AttemptExit));
     return true;
   }
 
   return false;
 }