Test downloads.download() disallows unsafe headers

chrome/browser/ui/webui/downloads_dom_handler.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/downloads_dom_handler.h"
 
 #include <algorithm>
 #include <functional>
 
 #include "base/basictypes.h"
@@ skipping 194 matching lines @@
                                      &download_items_);
   // If we have a parent DownloadManager, let it add its downloads to the
   // results.
   if (original_profile_download_manager_) {
     original_profile_download_manager_->SearchDownloads(
         WideToUTF16(search_text_), &download_items_);
   }
 
   sort(download_items_.begin(), download_items_.end(), DownloadItemSorter());
 
-  // Remove any extension downloads.
+  // Remove any extension downloads and hidden downloads.
   for (size_t i = 0; i < download_items_.size();) {
-    if (download_crx_util::IsExtensionDownload(*download_items_[i]))
+    if (download_crx_util::IsExtensionDownload(*download_items_[i]) ||
+        DownloadHidden::Get(download_items_[i]))
       download_items_.erase(download_items_.begin() + i);
     else
       i++;
   }
 
   // Add ourself to all download items as an observer.
   for (OrderedDownloads::iterator it = download_items_.begin();
        it != download_items_.end(); ++it) {
     if (static_cast<int>(it - download_items_.begin()) > kMaxDownloads)
       break;
@@ skipping 176 matching lines @@
 }
 
 content::DownloadItem* DownloadsDOMHandler::GetDownloadByValue(
     const ListValue* args) {
   int id;
   if (ExtractIntegerValue(args, &id)) {
     return GetDownloadById(id);
   }
   return NULL;
 }