Use about:blank as the failback URL if the filter denies a navigation.

content/browser/renderer_host/render_view_host_impl.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_IMPL_H_
 #define CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_IMPL_H_
 #pragma once
 
 #include <string>
 #include <vector>
@@ skipping 372 matching lines @@
   }
 
   const webkit_glue::WebAccessibility& accessibility_tree_for_testing() {
     return accessibility_tree_;
   }
 
   bool is_waiting_for_unload_ack_for_testing() {
     return is_waiting_for_unload_ack_;
   }
 
-  // Checks that the given renderer can request |url|, if not it sets it to an
-  // empty url.
+  // Checks that the given renderer can request |url|, if not it sets it to
+  // about:blank.
+  // empty_allowed must be set to false for navigations for security reasons.
   static void FilterURL(ChildProcessSecurityPolicyImpl* policy,
                         int renderer_id,
+                        bool empty_allowed,
                         GURL* url);
 
   // NOTE: Do not add functions that just send an IPC message that are called in
   // one or two places.  Have the caller send the IPC message directly.
 
  protected:
   friend class RenderViewHostObserver;
 
   // Add and remove observers for filtering IPC messages.  Clients must be sure
   // to remove the observer before they go away.
@@ skipping 215 matching lines @@
   DISALLOW_COPY_AND_ASSIGN(RenderViewHostImpl);
 };
 
 #if defined(COMPILER_MSVC)
 #pragma warning(pop)
 #endif
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_IMPL_H_