[Backport] CVE-2025-0447: Inappropriate implementation in Navigation

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/5973403:
Filter any URLs passed to the "redirect blocked" dialogs.

The framebusting mitigation from https://crbug.com/40084719 can block
subframes from navigating the main frame cross-origin without a user
gesture. However, the dialog allows the user to manually proceed to the
URL if desired.

This URL was not adequately filtered before, allowing chrome:// and
other privileged URLs to be used even if the renderer could not nomrally
navigate to them.  This CL adds the necessary filtering, which should
apply to both the desktop and Android dialogs.

Bug: 375550814
Change-Id: Icd518a869a06ad982767386d5d7a1528e6179e6c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5973403
Reviewed-by: Patrick Monette <[email protected]>
Reviewed-by: Nate Chapin <[email protected]>
Reviewed-by: Andy Paicu <[email protected]>
Reviewed-by: Liam Brady <[email protected]>
Auto-Submit: Charlie Reis <[email protected]>
Commit-Queue: Charlie Reis <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1377807}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/619215
Reviewed-by: Anu Aliyas <[email protected]>

Author: creis

chromium/content/browser/renderer_host/render_frame_host_impl.cc

@@ -6955,10 +6955,18 @@ void RenderFrameHostImpl::DidBlockNavigation(
     const GURL& blocked_url,
     const GURL& initiator_url,
     blink::mojom::NavigationBlockedReason reason) {
+  // Do not allow renderers to show off-limits URLs in the blocked dialog.
+  GURL validated_blocked_url = blocked_url;
+  GURL validated_initiator_url = initiator_url;
+  RenderProcessHost* process = GetProcess();
+  process->FilterURL(/*empty_allowed=*/false, &validated_blocked_url);
+  process->FilterURL(/*empty_allowed=*/false, &validated_initiator_url);
+
   // Cross-origin navigations are not allowed in prerendering so we can not
   // reach here while prerendering.
   DCHECK_NE(lifecycle_state(), LifecycleStateImpl::kPrerendering);
-  delegate_->OnDidBlockNavigation(blocked_url, initiator_url, reason);
+  delegate_->OnDidBlockNavigation(validated_blocked_url,
+                                  validated_initiator_url, reason);
 }
 
 void RenderFrameHostImpl::DidChangeLoadProgress(double load_progress) {