Move IsURLAcceptableForWebUI out of WebUIControllerFactory since its implementation is not really depended on chrome (other than calling UseWebUIForURL, which content can already call). This makes creatinga new WebUIControllerFactory for content's webui pages simpler.

BUG=169170
Review URL: https://codereview.chromium.org/12084018

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@179204 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 24 insertions, 11 deletions

diff --git a/content/browser/webui/web_ui_controller_factory_registry.cc b/content/browser/webui/web_ui_controller_factory_registry.cc
index 15c07e4..952d044 100644
--- a/content/browser/webui/web_ui_controller_factory_registry.cc
+++ b/content/browser/webui/web_ui_controller_factory_registry.cc
@@ -5,6 +5,8 @@
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
 
 #include "base/lazy_instance.h"
+#include "content/public/common/url_constants.h"
+#include "googleurl/src/gurl.h"
 
 namespace content {
 
@@ -78,14 +80,21 @@ bool WebUIControllerFactoryRegistry::IsURLAcceptableForWebUI(
     BrowserContext* browser_context,
     const GURL& url,
     bool data_urls_allowed) const {
-  std::vector<WebUIControllerFactory*>* factories = g_factories.Pointer();
-  for (size_t i = 0; i < factories->size(); ++i) {
-    if ((*factories)[i]->IsURLAcceptableForWebUI(
-            browser_context, url, data_urls_allowed)) {
-      return true;
-    }
-  }
-  return false;
+  return UseWebUIForURL(browser_context, url) ||
+      // javascript: URLs are allowed to run in Web UI pages.
+      url.SchemeIs(chrome::kJavaScriptScheme) ||
+      // It's possible to load about:blank in a Web UI renderer.
+      // See http://crbug.com/42547
+      url.spec() == chrome::kAboutBlankURL ||
+      // Chrome URLs crash, kill, hang, and shorthang are allowed.
+      url == GURL(chrome::kChromeUICrashURL) ||
+      url == GURL(chrome::kChromeUIKillURL) ||
+      url == GURL(chrome::kChromeUIHangURL) ||
+      url == GURL(content::kChromeUIShorthangURL) ||
+      // Data URLs are usually not allowed in WebUI for security reasons.
+      // BalloonHosts are one exception needed by ChromeOS, and are safe because
+      // they cannot be scripted by other pages.
+      (data_urls_allowed && url.SchemeIs(chrome::kDataScheme));
 }
 
 WebUIControllerFactoryRegistry::WebUIControllerFactoryRegistry() {
diff --git a/content/browser/webui/web_ui_controller_factory_registry.h b/content/browser/webui/web_ui_controller_factory_registry.h
index dbb93e2c..d821783 100644
--- a/content/browser/webui/web_ui_controller_factory_registry.h
+++ b/content/browser/webui/web_ui_controller_factory_registry.h
@@ -29,9 +29,13 @@ class CONTENT_EXPORT WebUIControllerFactoryRegistry
                               const GURL& url) const OVERRIDE;
   virtual bool UseWebUIBindingsForURL(BrowserContext* browser_context,
                                       const GURL& url) const OVERRIDE;
-  virtual bool IsURLAcceptableForWebUI(BrowserContext* browser_context,
-                                       const GURL& url,
-                                       bool data_urls_allowed) const OVERRIDE;
+
+  // Returns true if the given URL can be loaded by Web UI system. This allows
+  // URLs that UseWebUIForURL returns true for, and also URLs that can be loaded
+  // by normal tabs such as javascript: URLs or about:hang.
+  bool IsURLAcceptableForWebUI(BrowserContext* browser_context,
+                               const GURL& url,
+                               bool data_urls_allowed) const;
 
  private:
   friend struct DefaultSingletonTraits<WebUIControllerFactoryRegistry>;