GitLab

After this CL, chrome.tabs.update-initiated (and other
extension-API-initiated) navigations to about:newtab will navigate to
chrome://new-tab-page (similarly rewriting other URLs - e.g.
"about:version" => "chrome://version" or "localhost:1234" [wrong
scheme] to "http://localhost:1234").  This CL restores the old,
pre-r818969 behavior that some extensions depend on.

As pointed out in https://crbug.com/1145381#c4, exposing an ability to
manipulate URLs in an unexpected way may erode some of security benefits
that were achieved via an earlier r818969.  This additional security
risk seems acceptable because 1) this ability is only exposed to
extension origins and 2) the URL is mutated upfront, before a navigation
starts, 3) invalid URLs are rejected.

Fixed: 1145381
Change-Id: Ia1dd7d8a0f4fd373d04e1b1353419ac30f88eb06
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2519034Reviewed-by: Karan Bhatia <karandeepb@chromium.org>
Reviewed-by: Charlie Reis <creis@chromium.org>
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Cr-Commit-Position: refs/heads/master@{#827296}