Merge 32622 - fix url handling to only allow http and https URLs

BUG=none
TEST=none

Review URL: http://codereview.chromium.org/418011

TBR=erikkay@chromium.org
Review URL: http://codereview.chromium.org/503024

git-svn-id: svn://svn.chromium.org/chrome/branches/249/src@34667 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 11 insertions, 2 deletions

diff --git a/chrome/common/extensions/docs/examples/extensions/news/feed.html b/chrome/common/extensions/docs/examples/extensions/news/feed.html
index 001219b..6592a87 100644
--- a/chrome/common/extensions/docs/examples/extensions/news/feed.html
+++ b/chrome/common/extensions/docs/examples/extensions/news/feed.html
@@ -241,8 +241,17 @@ function buildPreview(doc) {
   }
 }
 
+// Show |url| in a new tab.
+function showUrl(url) {
+  // Only allow http and https URLs.
+  if (url.indexOf("http:") != 0 && url.indexOf("https:") != 0) {
+    return;
+  }
+  chrome.tabs.create({url: url});
+}
+
 function moreStories(event) {
-  chrome.tabs.create({url: moreStoriesUrl});
+  showUrl(moreStoriesUrl);
 }
 
 function showDesc(event) {
@@ -283,7 +292,7 @@ function iframeMessageHandler(e) {
                 url = url.substring(0, index);
             }
           }
-          chrome.tabs.create({url:url});
+          showUrl(url);
         }
       }
       return;