Code:  DevToolsUI::DevToolsUI(content::WebUI* web_ui)
    : WebUIController(web_ui) {
   web_ui->SetBindings(0);
   Profile* profile = Profile::FromWebUI(web_ui);
   content::URLDataSource::Add(
       profile,
       new DevToolsDataSource(profile->GetRequestContext()));
 
  GURL url = web_ui->GetWebContents()->GetVisibleURL();
  if (url.spec() != SanitizeFrontendURL(url).spec())
     return;
  if (profile->IsOffTheRecord()) {
    GURL site = content::SiteInstance::GetSiteForURL(profile, url);
    content::BrowserContext::GetStoragePartitionForSite(profile, site)->
        GetFileSystemContext()->EnableTemporaryFileSystemInIncognito();
  }
  bindings_.reset(new DevToolsUIBindings(web_ui->GetWebContents()));
 }

Vulnerability Type: +Info 
CWE ID: CWE-200
Summary: Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page.
Commit Message: DevTools: move front-end URL handling to DevToolsUIBindingds

BUG=662859

Review-Url: https://codereview.chromium.org/2607833002
Cr-Commit-Position: refs/heads/master@{#440926}