Treat files downloaded from the address bar as "always safe" (including extensions per discussion...

chrome/browser/download/chrome_download_manager_delegate.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/download/chrome_download_manager_delegate.h"
 
 #include "base/callback.h"
 #include "base/file_util.h"
 #include "base/path_service.h"
 #include "base/rand_util.h"
@@ skipping 239 matching lines @@
   float progress = 0;
   int download_count = 0;
   bool progress_known =
       g_browser_process->download_status_updater()->GetProgress(
           &progress, &download_count);
   download_util::UpdateAppIconDownloadProgress(
       download_count, progress_known, progress);
 }
 
 void ChromeDownloadManagerDelegate::CheckDownloadUrlDone(
-    int32 download_id, bool is_dangerous_url) {
+    int32 download_id,
+    bool is_dangerous_url) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   DownloadItem* download =
       download_manager_->GetActiveDownloadItem(download_id);
   if (!download)
     return;
 
   if (is_dangerous_url)
     download->MarkUrlDangerous();
 
-  download_history_->CheckVisitedReferrerBefore(
-      download_id,
-      download->referrer_url(),
-      NewCallback(this,
+  download_history_->CheckVisitedReferrerBefore(download_id,
+      download->referrer_url(), NewCallback(this,
           &ChromeDownloadManagerDelegate::CheckVisitedReferrerBeforeDone));
 }
 
 // NotificationObserver implementation.
 void ChromeDownloadManagerDelegate::Observe(
     int type,
     const NotificationSource& source,
     const NotificationDetails& details) {
   DCHECK(type == chrome::NOTIFICATION_CRX_INSTALLER_DONE);
 
@@ skipping 182 matching lines @@
   download_manager_->RestartDownload(download_id);
 }
 
 // TODO(phajdan.jr): This is apparently not being exercised in tests.
 bool ChromeDownloadManagerDelegate::IsDangerousFile(
     const DownloadItem& download,
     const DownloadStateInfo& state,
     bool visited_referrer_before) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
-  bool auto_open = ShouldOpenFileBasedOnExtension(state.suggested_path);
-  download_util::DownloadDangerLevel danger_level =
-      download_util::GetFileDangerLevel(state.suggested_path.BaseName());
+  // Anything loaded directly from the address bar is OK.
+  if (state.transition_type & PageTransition::FROM_ADDRESS_BAR)
+    return false;
 
-  if (danger_level == download_util::Dangerous)
-    return !(auto_open && state.has_user_gesture);
-
-  if (danger_level == download_util::AllowOnUserGesture &&
-      (!state.has_user_gesture || !visited_referrer_before))
-    return true;
-
+  // Extensions that are not from the gallery are considered dangerous.
   if (IsExtensionDownload(&download)) {
-    // Extensions that are not from the gallery are considered dangerous.
     ExtensionService* service = profile_->GetExtensionService();
     if (!service || !service->IsDownloadFromGallery(download.GetURL(),
                                                     download.referrer_url()))
       return true;
   }
-  return false;
+
+  // Anything the user has marked auto-open is OK if it's user-initiated.
+  if (ShouldOpenFileBasedOnExtension(state.suggested_path) &&
+      state.has_user_gesture)
+    return false;
+
+  // "Allow on user gesture" is OK when we have a user gesture and the hosting
+  // page has been visited before today.
+  download_util::DownloadDangerLevel danger_level =
+      download_util::GetFileDangerLevel(state.suggested_path.BaseName());
+  if (danger_level == download_util::AllowOnUserGesture)
+    return !state.has_user_gesture || !visited_referrer_before;
+
+  return danger_level == download_util::Dangerous;
 }
 
 void ChromeDownloadManagerDelegate::OnItemAddedToPersistentStore(
     int32 download_id, int64 db_handle) {
   // It's not immediately obvious, but HistoryBackend::CreateDownload() can
   // call this function with an invalid |db_handle|. For instance, this can
   // happen when the history database is offline. We cannot have multiple
   // DownloadItems with the same invalid db_handle, so we need to assign a
   // unique |db_handle| here.
   if (db_handle == DownloadItem::kUninitializedHandle)
     db_handle = download_history_->GetNextFakeDbHandle();
   download_manager_->OnItemAddedToPersistentStore(download_id, db_handle);
 }