[DevTools] Whitelist remoteBase and loadNetworkResource schemes.

BUG=571121

Review URL: https://codereview.chromium.org/1586903002

Cr-Commit-Position: refs/heads/master@{#369327}

chrome/browser/devtools/devtools_ui_bindings.cc

@@ -652,7 +652,10 @@ void DevToolsUIBindings::LoadNetworkResource(const DispatchCallback& callback,
                                              const std::string& headers,
                                              int stream_id) {
   GURL gurl(url);
-  if (!gurl.is_valid()) {
+  bool schemeIsAllowed = gurl.is_valid() &&
+      (gurl.SchemeIs(url::kHttpScheme) || gurl.SchemeIs(url::kHttpsScheme) ||
+       gurl.SchemeIs(url::kDataScheme) || gurl.SchemeIs(url::kFtpScheme));
+  if (!gurl.is_valid() || !schemeIsAllowed) {
     base::DictionaryValue response;
     response.SetInteger("statusCode", 404);
     callback.Run(&response);

third_party/WebKit/Source/devtools/front_end/Runtime.js

@@ -1093,6 +1093,11 @@ Runtime.experiments = new Runtime.ExperimentsSupport();
  * @type {?string}
  */
 Runtime._remoteBase = Runtime.queryParam("remoteBase");
+{(function validateRemoteBase()
+{
+    if (Runtime._remoteBase && !Runtime._remoteBase.startsWith("https://chrome-devtools-frontend.appspot.com/"))
+        Runtime._remoteBase = null;
+})();}
 
 /**
  * @param {string} path