Ensure we display all non-WebUI URLs, as a second line of defense.
BUG=70819
TEST=Load a normal URL in an extension process (currently not possible).
Review URL: http://codereview.chromium.org/6526030
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@75071 0039d316-1c4b-4281-b951-d872f2087c98
diff --git a/chrome/browser/tab_contents/tab_contents.cc b/chrome/browser/tab_contents/tab_contents.cc
index 264a29d..2fd6ea12 100644
--- a/chrome/browser/tab_contents/tab_contents.cc
+++ b/chrome/browser/tab_contents/tab_contents.cc
@@ -657,6 +657,10 @@
return true;
}
+ // We always display the URL for non-WebUI URLs to prevent spoofing.
+ if (entry && !WebUIFactory::HasWebUIScheme(entry->url()))
+ return true;
+
WebUI* web_ui = GetWebUIForCurrentState();
if (web_ui)
return !web_ui->should_hide_url();
