Code: GURL SanitizeFrontendURL(
    const GURL& url,
    const std::string& scheme,
    const std::string& host,
    const std::string& path,
    bool allow_query) {
  std::vector<std::string> query_parts;
  if (allow_query) {
    for (net::QueryIterator it(url); !it.IsAtEnd(); it.Advance()) {
      std::string value = SanitizeFrontendQueryParam(it.GetKey(),
          it.GetValue());
      if (!value.empty()) {
        query_parts.push_back(
            base::StringPrintf("%s=%s", it.GetKey().c_str(), value.c_str()));
      }
    }
  }
  std::string query =
      query_parts.empty() ? "" : "?" + base::JoinString(query_parts, "&");
  std::string constructed = base::StringPrintf("%s://%s%s%s",
      scheme.c_str(), host.c_str(), path.c_str(), query.c_str());
  GURL result = GURL(constructed);
  if (!result.is_valid())
    return GURL();
  return result;
}

Vulnerability Type: +Info 
CWE ID: CWE-200
Summary: Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page.
Commit Message: DevTools: move front-end URL handling to DevToolsUIBindingds

BUG=662859

Review-Url: https://codereview.chromium.org/2607833002
Cr-Commit-Position: refs/heads/master@{#440926}