Code: int OmniboxViewWin::OnPerformDropImpl(const views::DropTargetEvent& event,
                                      bool in_drag) {
  const ui::OSExchangeData& data = event.data();

  if (data.HasURL()) {
    GURL url;
    string16 title;
     if (data.GetURLAndTitle(&url, &title)) {
       string16 text(StripJavascriptSchemas(UTF8ToUTF16(url.spec())));
       SetUserText(text);
      if (url.spec().length() == text.length())
        model()->AcceptInput(CURRENT_TAB, true);
       return CopyOrLinkDragOperation(event.source_operations());
     }
   } else if (data.HasString()) {
    int string_drop_position = drop_highlight_position();
    string16 text;
    if ((string_drop_position != -1 || !in_drag) && data.GetString(&text)) {
      DCHECK(string_drop_position == -1 ||
             ((string_drop_position >= 0) &&
              (string_drop_position <= GetTextLength())));
      if (in_drag) {
        if (event.source_operations()== ui::DragDropTypes::DRAG_MOVE)
          MoveSelectedText(string_drop_position);
        else
          InsertText(string_drop_position, text);
      } else {
        PasteAndGo(CollapseWhitespace(text, true));
      }
      return CopyOrLinkDragOperation(event.source_operations());
    }
  }

  return ui::DragDropTypes::DRAG_NONE;
}

Vulnerability Type: 
CWE ID: 
Summary: Google Chrome before 17.0.963.46 does not properly implement the drag-and-drop feature, which makes it easier for remote attackers to spoof the URL bar via unspecified vectors.
Commit Message: Change omnibox behavior when stripping javascript schema to navigate after stripping the schema on drag drop.

BUG=109245
TEST=N/A
Review URL: http://codereview.chromium.org/9116016

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@116692 0039d316-1c4b-4281-b951-d872f2087c98