Code: bool DebuggerFunction::InitTabContents() {
  Value* debuggee;
  EXTENSION_FUNCTION_VALIDATE(args_->Get(0, &debuggee));

  DictionaryValue* dict = static_cast<DictionaryValue*>(debuggee);
  EXTENSION_FUNCTION_VALIDATE(dict->GetInteger(keys::kTabIdKey, &tab_id_));

  contents_ = NULL;
  TabContentsWrapper* wrapper = NULL;
  bool result = ExtensionTabUtil::GetTabById(
      tab_id_, profile(), include_incognito(), NULL, NULL, &wrapper, NULL);
  if (!result || !wrapper) {
    error_ = ExtensionErrorUtils::FormatErrorMessage(
        keys::kNoTabError,
        base::IntToString(tab_id_));
    return false;
   }
   contents_ = wrapper->web_contents();
 
  if (ChromeWebUIControllerFactory::GetInstance()->HasWebUIScheme(
           contents_->GetURL())) {
     error_ = ExtensionErrorUtils::FormatErrorMessage(
         keys::kAttachToWebUIError,
        contents_->GetURL().scheme());
    return false;
  }

  return true;
}

Vulnerability Type: Bypass 
CWE ID: CWE-264
Summary: Google Chrome before 19.0.1084.46 does not use a dedicated process for the loading of links found on an internal page, which might allow attackers to bypass intended sandbox restrictions via a crafted page.
Commit Message: Allow browser to handle all WebUI navigations.

BUG=113496
TEST="Google Dashboard" link in Sync settings loads in new process.


Review URL: http://codereview.chromium.org/9663045

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@126949 0039d316-1c4b-4281-b951-d872f2087c98