Make it so the user can't drag javascript: links to the

desktop from web content or the bookmarks bar.  Maintain
the ability to drag javascript: links from web content
to the bookmarks bar or to drag the javascript: link as
plain text.

BUG=3431
Review URL: http://codereview.chromium.org/8638

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@4050 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 28 insertions, 5 deletions

diff --git a/chrome/browser/bookmarks/bookmark_drag_data.cc b/chrome/browser/bookmarks/bookmark_drag_data.cc
index 85911a7..c55d24f 100644
--- a/chrome/browser/bookmarks/bookmark_drag_data.cc
+++ b/chrome/browser/bookmarks/bookmark_drag_data.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/bookmarks/bookmark_drag_data.h"
 
 #include "base/pickle.h"
+#include "base/string_util.h"
 #include "chrome/browser/bookmarks/bookmark_model.h"
 #include "chrome/browser/profile.h"
 #include "chrome/common/os_exchange_data.h"
@@ -82,8 +83,13 @@ void BookmarkDragData::Write(Profile* profile, OSExchangeData* data) const {
 
   // If there is only one element and it is a URL, write the URL to the
   // clipboard.
-  if (elements.size() == 1 && elements[0].is_url)
-    data->SetURL(elements[0].url, elements[0].title);
+  if (elements.size() == 1 && elements[0].is_url) {
+    if (elements[0].url.SchemeIs("javascript")) {
+      data->SetString(ASCIIToWide(elements[0].url.spec()));
+    } else {
+      data->SetURL(elements[0].url, elements[0].title);
+    }
+  }
 
   Pickle data_pickle;
   data_pickle.WriteWString(profile->GetPath());
diff --git a/chrome/browser/web_contents_view_win.cc b/chrome/browser/web_contents_view_win.cc
index 9d2561b..17e8b75 100644
--- a/chrome/browser/web_contents_view_win.cc
+++ b/chrome/browser/web_contents_view_win.cc
@@ -6,6 +6,7 @@
 
 #include <windows.h>
 
+#include "chrome/browser/bookmarks/bookmark_drag_data.h"
 #include "chrome/browser/browser.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/download/download_request_manager.h"
@@ -94,15 +95,31 @@ void WebContentsViewWin::StartDragging(const WebDropData& drop_data) {
 
   // We set the file contents before the URL because the URL also sets file
   // contents (to a .URL shortcut).  We want to prefer file content data over a
-  // shortcut.
+  // shortcut so we add it first.
   if (!drop_data.file_contents.empty()) {
     data->SetFileContents(drop_data.file_description_filename,
                           drop_data.file_contents);
   }
   if (!drop_data.cf_html.empty())
     data->SetCFHtml(drop_data.cf_html);
-  if (drop_data.url.is_valid())
-    data->SetURL(drop_data.url, drop_data.url_title);
+  if (drop_data.url.is_valid()) {
+    if (drop_data.url.SchemeIs("javascript")) {
+      // We don't want to allow javascript URLs to be dragged to the desktop,
+      // but we do want to allow them to be added to the bookmarks bar
+      // (bookmarklets).
+      BookmarkDragData::Element bm_elt;
+      bm_elt.is_url = true;
+      bm_elt.url = drop_data.url;
+      bm_elt.title = drop_data.url_title;
+
+      BookmarkDragData bm_drag_data;
+      bm_drag_data.elements.push_back(bm_elt);
+
+      bm_drag_data.Write(web_contents_->profile(), data);
+    } else {
+      data->SetURL(drop_data.url, drop_data.url_title);
+    }
+  }
   if (!drop_data.plain_text.empty())
     data->SetString(drop_data.plain_text);