diff options
| author | johnnyg@chromium.org <johnnyg@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-06-09 21:47:02 +0000 |
|---|---|---|
| committer | johnnyg@chromium.org <johnnyg@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-06-09 21:47:02 +0000 |
| commit | 1ec4e04d215b1952a9ae634a26aa068844cc7c5f (patch) | |
| tree | 3ae6553100bf7fc14aa6f15f8a3dc82fc78d53b0 | |
| parent | d409efc2563bf8b647dac1af324c26778809985c (diff) | |
| download | chromium_src-1ec4e04d215b1952a9ae634a26aa068844cc7c5f.zip chromium_src-1ec4e04d215b1952a9ae634a26aa068844cc7c5f.tar.gz chromium_src-1ec4e04d215b1952a9ae634a26aa068844cc7c5f.tar.bz2 | |
Allow creating HTML notifications with the data: scheme. I've confirmed this doesn't open up the same extra privileges as javascript: scheme, which is still disallowed.
BUG=32470
TEST=create HTML notifications using data:
Review URL: http://codereview.chromium.org/2779005
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@49327 0039d316-1c4b-4281-b951-d872f2087c98
| -rw-r--r-- | chrome/renderer/notification_provider.cc | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/chrome/renderer/notification_provider.cc b/chrome/renderer/notification_provider.cc index 4642cff..414966f 100644 --- a/chrome/renderer/notification_provider.cc +++ b/chrome/renderer/notification_provider.cc @@ -95,11 +95,13 @@ void NotificationProvider::OnNavigate() { bool NotificationProvider::ShowHTML(const WebNotification& notification, int id) { - // Disallow HTML notifications from non-HTTP schemes. + // Disallow HTML notifications from unwanted schemes. javascript: + // in particular allows unwanted cross-domain access. GURL url = notification.url(); if (!url.SchemeIs(chrome::kHttpScheme) && !url.SchemeIs(chrome::kHttpsScheme) && - !url.SchemeIs(chrome::kExtensionScheme)) + !url.SchemeIs(chrome::kExtensionScheme) && + !url.SchemeIs(chrome::kDataScheme)) return false; DCHECK(notification.isHTML()); |