diff options
| author | cpu@google.com <cpu@google.com@0039d316-1c4b-4281-b951-d872f2087c98> | 2008-12-16 18:47:34 +0000 |
|---|---|---|
| committer | cpu@google.com <cpu@google.com@0039d316-1c4b-4281-b951-d872f2087c98> | 2008-12-16 18:47:34 +0000 |
| commit | 030eeceb949afae4093ae5ce6ac23650aaa37d04 (patch) | |
| tree | 2e58edb2d73fe6413f2e45954565e115c8f46394 /chrome | |
| parent | d65e942e2191a9c57085374fc02b3230a55bdc81 (diff) | |
| download | chromium_src-030eeceb949afae4093ae5ce6ac23650aaa37d04.zip chromium_src-030eeceb949afae4093ae5ce6ac23650aaa37d04.tar.gz chromium_src-030eeceb949afae4093ae5ce6ac23650aaa37d04.tar.bz2 | |
Fixes crash at ResourceDispatcherHost::BeginDownload
- It is a 'planned' crash in a CHECK(false)
- Now is a bug because the user can trigger it by alt-click in a <a href=data:xxxxx >
The codepath in question skips all the checks we do in the downloadmanager and on the UI command handlers.
BUG=5112
Review URL: http://codereview.chromium.org/12968
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@7069 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome')
| -rw-r--r-- | chrome/browser/resource_dispatcher_host.cc | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/chrome/browser/resource_dispatcher_host.cc b/chrome/browser/resource_dispatcher_host.cc index 9062d2b..1d1aa18 100644 --- a/chrome/browser/resource_dispatcher_host.cc +++ b/chrome/browser/resource_dispatcher_host.cc @@ -1609,6 +1609,9 @@ void ResourceDispatcherHost::BeginDownload(const GURL& url, if (is_shutdown_) return; + if (!URLRequest::IsHandledURL(url)) + return; + // Check if the renderer is permitted to request the requested URL. // // TODO(mpcomplete): remove "render_process_host_id != -1" @@ -1649,11 +1652,6 @@ void ResourceDispatcherHost::BeginDownload(const GURL& url, this); } - bool known_proto = URLRequest::IsHandledURL(url); - if (!known_proto) { - CHECK(false); - } - request->set_method("GET"); request->set_referrer(referrer.spec()); request->set_context(request_context); |