Fix: file permissions when restoring a page with file inputs with selected files.

webkit/glue/glue_serialize.cc

Index: webkit/glue/glue_serialize.cc
diff --git a/webkit/glue/glue_serialize.cc b/webkit/glue/glue_serialize.cc
index 4ee3bec89b80a25b51fb43dacf50eb225a2fad03..f2a316b63a782a1c5df135efed6a4d513a84da8b 100644
--- a/webkit/glue/glue_serialize.cc
+++ b/webkit/glue/glue_serialize.cc
@@ -7,6 +7,7 @@
 #include <string>
 
 #include "base/pickle.h"
+#include "base/string_number_conversions.h"
 #include "base/utf_string_conversions.h"
 #include "googleurl/src/gurl.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebData.h"
@@ -560,6 +561,56 @@ std::vector<FilePath> FilePathsFromHistoryState(
   return to_return;
 }
 
+std::vector<FilePath> FilePathsFromInputsInHistoryState(
+    const std::string& content_state) {
+  std::vector<FilePath> to_return;
+  // TODO(darin): We should avoid using the WebKit API here, so that we do not
+  // need to have WebKit initialized before calling this method.
+  const WebHistoryItem& item =
+      HistoryItemFromString(content_state, ALWAYS_INCLUDE_FORM_DATA, true);
+  if (item.isNull()) {
+    // Couldn't parse the string.
+    return to_return;
+  }
+  const WebVector<WebString>& document_state = item.documentState();
+  if (document_state.isEmpty())
+    return to_return;
+  // The first entry contains the version number of the document state. Check
+  // the version here, otherwise this might result in granting file permissions
+  // to wrong files.
+  if (std::string(document_state[0].utf8()).find(
+      "WebKit serialized form state version 5") == std::string::npos)
+    return to_return;
+
+  // For each document element, the vector contains the following entries:

[brettw, 2012/07/11 00:02:42]

WE don't want to do this type of manual parsing where we assume a certain
serialization format that WebKit might do. You can see that the
FilePathsFromHistoryState uses aonly WebKit API functions to do what it needs.
We should do the same here, adding them if what we need doesn't exist.

[marja, 2012/08/22 09:04:28]

Done.

+  // - name
+  // - form control type
+  // - form key
+  // - number of additional fields
+  // - additional field 1
+  // - ...
+  // - additional field n
+  size_t i = 1;  // Skip the first entry.
+  while (i + 3 < document_state.size()) {
+    int fields;
+    if (!base::StringToInt(std::string(document_state[i + 3].utf8()), &fields))
+      break;
+    if (i + 3 + fields >= document_state.size())
+      break;
+    if (document_state[i + 1] == "file") {
+      for (size_t j = i + 4; j < i + 4 + fields; j += 2) {
+        // For file inputs, the additional fields are:
+        // - file path
+        // - file name
+        to_return.push_back(WebStringToFilePath(document_state[j]));
+      }
+    }
+    // Jump to the next entry.
+    i += (4 + fields);
+  }
+  return to_return;
+}
+
 // For testing purposes only.
 void HistoryItemToVersionedString(const WebHistoryItem& item, int version,
                                   std::string* serialized_item) {