Limiting the "Cookies and site data" form to "web safe" schemes.

chrome/browser/browsing_data_indexed_db_helper.cc

Index: chrome/browser/browsing_data_indexed_db_helper.cc
diff --git a/chrome/browser/browsing_data_indexed_db_helper.cc b/chrome/browser/browsing_data_indexed_db_helper.cc
index fea3b26d0f6cf3c56a98d7029811211d9820dba5..431ea51eea9bca527e478b05077f96d4cc8aa1bc 100644
--- a/chrome/browser/browsing_data_indexed_db_helper.cc
+++ b/chrome/browser/browsing_data_indexed_db_helper.cc
@@ -14,6 +14,7 @@
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/profiles/profile.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/indexed_db_context.h"
 #include "webkit/database/database_util.h"
 #include "webkit/glue/webkit_glue.h"
@@ -105,11 +106,14 @@ void BrowsingDataIndexedDBHelperImpl::DeleteIndexedDB(
 void BrowsingDataIndexedDBHelperImpl::FetchIndexedDBInfoInWebKitThread() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT_DEPRECATED));
   std::vector<GURL> origins = indexed_db_context_->GetAllOrigins();
+  content::ChildProcessSecurityPolicy* policy =
+      content::ChildProcessSecurityPolicy::GetInstance();
   for (std::vector<GURL>::const_iterator iter = origins.begin();
        iter != origins.end(); ++iter) {
     const GURL& origin = *iter;
-    if (origin.SchemeIs(chrome::kExtensionScheme))
-      continue;  // Extension state is not considered browsing data.
+    if (!policy->IsWebSafeScheme(origin.scheme()))
+      continue;  // Non-websafe state is not considered browsing data.
+
     indexed_db_info_.push_back(IndexedDBInfo(
         origin,
         indexed_db_context_->GetOriginDiskUsage(origin),
@@ -190,6 +194,11 @@ CannedBrowsingDataIndexedDBHelper* CannedBrowsingDataIndexedDBHelper::Clone() {
 
 void CannedBrowsingDataIndexedDBHelper::AddIndexedDB(
     const GURL& origin, const string16& description) {
+  content::ChildProcessSecurityPolicy* policy =
+      content::ChildProcessSecurityPolicy::GetInstance();
+  if (!policy->IsWebSafeScheme(origin.scheme()))
+    return;  // Non-websafe state is not considered browsing data.
+
   base::AutoLock auto_lock(lock_);
   pending_indexed_db_info_.push_back(PendingIndexedDBInfo(origin, description));
 }