Do not allow HTTP refresh headers to refresh to javascript: URLs.

Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <[email protected]>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <[email protected]>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 520 matching lines @@
 
     double delay;
     String url;
     if (!parseHTTPRefresh(m_documentLoader->response().httpHeaderField("Refresh"), false, delay, url))
         return;
     if (url.isEmpty())
         url = m_frame->document()->url().string();
     else
         url = m_frame->document()->completeURL(url).string();
 
-    m_frame->navigationScheduler()->scheduleRedirect(delay, url);
+    if (!protocolIsJavaScript(url)) {
+        m_frame->navigationScheduler()->scheduleRedirect(delay, url);
+    } else {
+        String message = "Refused to refresh " + m_frame->document()->url().elidedString() + " to a javascript: URL";
+        m_frame->document()->addConsoleMessage(SecurityMessageSource, ErrorMessageLevel, message);
+    }
 }
 
 void FrameLoader::setOutgoingReferrer(const KURL& url)
 {
     m_outgoingReferrer = url.strippedForUseAsReferrer();
 }
 
 void FrameLoader::didBeginDocument(bool dispatch)
 {
     m_needsClear = true;
@@ skipping 1960 matching lines @@
     FloatRect newWindowRect = DOMWindow::adjustWindowRect(page, windowRect);
 
     page->chrome().setWindowRect(newWindowRect);
     page->chrome().show();
 
     created = true;
     return frame;
 }
 
 } // namespace WebCore