Treat files downloaded from the address bar as "always safe" (including extensions per discussion...

chrome/browser/ui/browser_navigator.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/browser_navigator.h"
 
 #include <algorithm>
 
 #include "base/command_line.h"
 #include "chrome/browser/browser_about_handler.h"
@@ skipping 349 matching lines @@
   if (params->window_action == browser::NavigateParams::SHOW_WINDOW &&
       params->disposition == NEW_POPUP &&
       params->user_gesture == false) {
     params->window_action = browser::NavigateParams::SHOW_WINDOW_INACTIVE;
   }
 
   // Determine if the navigation was user initiated. If it was, we need to
   // inform the target TabContents, and we may need to update the UI.
   PageTransition::Type base_transition =
       PageTransition::StripQualifier(params->transition);
-  bool user_initiated = base_transition == PageTransition::TYPED ||
-                        base_transition == PageTransition::AUTO_BOOKMARK;
+  bool user_initiated = params->transition & PageTransition::FROM_ADDRESS_BAR ||

[sky, 2011/08/18 00:13:00]

How unlike you not to use () around all these.

+      base_transition == PageTransition::TYPED ||
+      base_transition == PageTransition::AUTO_BOOKMARK ||
+      base_transition == PageTransition::GENERATED ||
+      base_transition == PageTransition::START_PAGE ||

[sky, 2011/08/18 00:13:00]

How come you're adding START_PAGE here?

[Peter Kasting, 2011/08/18 00:53:39]

It seemed like starting the browser ought to qualify as something the user
intentionally did, and the start page shouldn't be DDoS restricted.  But maybe
this is inappropriate.  You're right that this bends the definition a bit.  I'm
not sure which way to go.

[sky, 2011/08/19 17:34:35]

Peter stopped by and we talked about START_PAGE. Since START_PAGE is typically
used when the user actually launches the app it seems fine to make it user
initiated.

+      base_transition == PageTransition::RELOAD ||
+      base_transition == PageTransition::KEYWORD;
 
   // Check if this is a singleton tab that already exists
   int singleton_index = GetIndexOfSingletonTab(params);
 
   // If no target TabContents was specified, we need to construct one if we are
   // supposed to target a new tab; unless it's a singleton that already exists.
   if (!params->target_contents && singleton_index < 0) {
     GURL url = params->url.is_empty() ? params->browser->GetHomePage()
                                       : params->url;
     if (params->disposition != CURRENT_TAB) {
@@ skipping 132 matching lines @@
                                     rewritten_url, replacements)) {
       params->target_contents = tab;
       return tab_index;
     }
   }
 
   return -1;
 }
 
 }  // namespace browser