Filter more incoming URLs in the CreateWindow path.

content/browser/renderer_host/render_view_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_view_host_impl.h"
 
 #include <set>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 1076 matching lines @@
   return true;
 }
 
 void RenderViewHostImpl::CreateNewWindow(
     int route_id,
     const ViewHostMsg_CreateWindow_Params& params,
     SessionStorageNamespace* session_storage_namespace) {
   ViewHostMsg_CreateWindow_Params validated_params(params);
   ChildProcessSecurityPolicyImpl* policy =
       ChildProcessSecurityPolicyImpl::GetInstance();
-  // TODO(cevans): also validate opener_url, opener_security_origin.
   FilterURL(policy, GetProcess(), false, &validated_params.target_url);
+  FilterURL(policy, GetProcess(), false, &validated_params.opener_url);
+  FilterURL(policy, GetProcess(), true,
+            &validated_params.opener_security_origin);
 
   delegate_->CreateNewWindow(route_id, validated_params,
                              session_storage_namespace);
 }
 
 void RenderViewHostImpl::CreateNewWidget(int route_id,
                                      WebKit::WebPopupType popup_type) {
   delegate_->CreateNewWidget(route_id, popup_type);
 }
 
@@ skipping 992 matching lines @@
           GetRoutingID(), snapshot_id, snapshot_size, png));
       return;
     }
   }
 
   Send(new ViewMsg_WindowSnapshotCompleted(
       GetRoutingID(), snapshot_id, gfx::Size(), png));
 }
 
 }  // namespace content