Code: void RenderMessageFilter::OnCreateWindow(
    const ViewHostMsg_CreateWindow_Params& params,
    int* route_id,
    int* surface_id,
    int64* cloned_session_storage_namespace_id) {
   bool no_javascript_access;
   bool can_create_window =
       GetContentClient()->browser()->CanCreateWindow(
          GURL(params.opener_url),
          GURL(params.opener_security_origin),
           params.window_container_type,
           resource_context_,
           render_process_id_,
          &no_javascript_access);

  if (!can_create_window) {
    *route_id = MSG_ROUTING_NONE;
    *surface_id = 0;
    return;
  }

  scoped_refptr<SessionStorageNamespaceImpl> cloned_namespace =
      new SessionStorageNamespaceImpl(dom_storage_context_,
                                      params.session_storage_namespace_id);
  *cloned_session_storage_namespace_id = cloned_namespace->id();

  render_widget_helper_->CreateNewWindow(params,
                                         no_javascript_access,
                                         peer_handle(),
                                         route_id,
                                         surface_id,
                                         cloned_namespace);
}

Vulnerability Type: 
CWE ID: 
Summary: Google Chrome before 24.0.1312.56 does not validate URLs during the opening of new windows, which has unspecified impact and remote attack vectors.
Commit Message: Filter more incoming URLs in the CreateWindow path.

BUG=170532

Review URL: https://chromiumcodereview.appspot.com/12036002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@178728 0039d316-1c4b-4281-b951-d872f2087c98