DragEnter grants both read and navigate permissions to files.

content/browser/renderer_host/render_view_host_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/utf_string_conversions.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/renderer_host/test_render_view_host.h"
 #include "content/browser/web_contents/navigation_controller_impl.h"
 #include "content/browser/web_contents/test_web_contents.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/page_transition_types.h"
 #include "content/test/mock_render_process_host.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDragOperation.h"
@@ skipping 142 matching lines @@
   drop_data.html_base_url = http_url;
   test_rvh()->TestOnMsgStartDragging(drop_data);
   EXPECT_EQ(javascript_url, view_delegate.drag_url());
   EXPECT_EQ(http_url, view_delegate.html_base_url());
 }
 
 TEST_F(RenderViewHostTest, DragEnteredFileURLsStillBlocked) {
   WebDropData dropped_data;
   gfx::Point client_point;
   gfx::Point screen_point;
-  GURL file_url = GURL("file:///etc/passwd");
-  dropped_data.url = file_url;
+  FilePath highlighted_file_path(FILE_PATH_LITERAL("/etc/passwd"));
+  FilePath selected_file_path(FILE_PATH_LITERAL("/tmp/image.jpg"));
+  GURL highlighted_file_url = net::FilePathToFileURL(highlighted_file_path);
+  GURL selected_file_url = net::FilePathToFileURL(selected_file_path);
+  dropped_data.url = highlighted_file_url;
+  dropped_data.filenames.push_back(WebDropData::FileInfo(
+      UTF8ToUTF16(selected_file_path.AsUTF8Unsafe()), string16()));
+
   rvh()->DragTargetDragEnter(dropped_data, client_point, screen_point,
                              WebKit::WebDragOperationNone);
-  EXPECT_FALSE(ChildProcessSecurityPolicyImpl::GetInstance()->CanRequestURL(
-      process()->GetID(), file_url));
+
+  int id = process()->GetID();
+  ChildProcessSecurityPolicyImpl* policy =
+      ChildProcessSecurityPolicyImpl::GetInstance();
+
+  EXPECT_FALSE(policy->CanRequestURL(id, highlighted_file_url));
+  EXPECT_FALSE(policy->CanReadFile(id, highlighted_file_path));
+  EXPECT_FALSE(policy->CanRequestURL(id, selected_file_url));
+  EXPECT_TRUE(policy->CanReadFile(id, selected_file_path));
 }
 
 // The test that follow trigger DCHECKS in debug build.
 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON)
 
 // Test that when we fail to de-serialize a message, RenderViewHost calls the
 // ReceivedBadMessage() handler.
 TEST_F(RenderViewHostTest, BadMessageHandlerRenderViewHost) {
   EXPECT_EQ(0, process()->bad_msg_count());
   // craft an incorrect ViewHostMsg_UpdateTargetURL message. The real one has
@@ skipping 23 matching lines @@
   // the code actually expects it to have at least one int para, this this
   // bogus message will not fail at de-serialization but should fail in
   // OnMsgInputEventAck() processing.
   IPC::Message message(0, ViewHostMsg_HandleInputEvent_ACK::ID,
                        IPC::Message::PRIORITY_NORMAL);
   test_rvh()->OnMessageReceived(message);
   EXPECT_EQ(1, process()->bad_msg_count());
 }
 
 #endif