Replace whitespace at beginning and end of file with hyphens, rather than silently discarding.

net/base/net_util.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/net_util.h"
 
 #include <unicode/regex.h>
 #include <unicode/ucnv.h>
 #include <unicode/uidna.h>
 #include <unicode/ulocdata.h>
@@ skipping 140 matching lines @@
   0xFFFF, // Used to block all invalid port numbers (see
           // third_party/WebKit/Source/WebCore/platform/KURLGoogle.cpp, port())
 };
 
 // FTP overrides the following restricted ports.
 static const int kAllowedFtpPorts[] = {
   21,   // ftp data
   22,   // ssh
 };
 
+std::string::size_type CountTrailingChars(
+    const std::string input,
+    const std::string::value_type trailing_chars[]) {
+  const std::string::size_type last_good_char =
+      input.find_last_not_of(trailing_chars);
+
+  if (last_good_char == std::string::npos)
+    return input.length();
+  else
+    return input.length() - last_good_char - 1;
+}
+
 // Similar to Base64Decode. Decodes a Q-encoded string to a sequence
 // of bytes. If input is invalid, return false.
 bool QPDecode(const std::string& input, std::string* output) {
   std::string temp;
   temp.reserve(input.size());
   std::string::const_iterator it = input.begin();
   while (it != input.end()) {
     if (*it == '_') {
       temp.push_back(' ');
     } else if (*it == '=') {
@@ skipping 1280 matching lines @@
 
   // Finally try the URL hostname, but only if there's no default specified in
   // |default_name|.  Some schemes (e.g.: file:, about:, data:) do not have a
   // host name.
   if (filename.empty() && default_name.empty() &&
       url.is_valid() && !url.host().empty()) {
     // TODO(jungshik) : Decode a 'punycoded' IDN hostname. (bug 1264451)
     filename = url.host();
   }
 
+#if defined(OS_WIN)
+  std::string::size_type trimmed_trailing_character_count =
+      CountTrailingChars(filename, " .");
+#endif
   SanitizeGeneratedFileName(filename);
   // Sanitization can cause the filename to disappear (e.g.: if the filename
   // consisted entirely of spaces and '.'s), in which case we use the default.
-  if (filename.empty() && default_name.empty())
-    filename = kFinalFallbackName;
+  if (filename.empty()) {
+#if defined(OS_WIN)
+    trimmed_trailing_character_count = 0;
+#endif
+    if (default_name.empty())
+      filename = kFinalFallbackName;
+  }
 
 #if defined(OS_WIN)
   string16 path = (filename.empty())? default_name : UTF8ToUTF16(filename);
+  // On Windows we want to preserve or replace all characters including
+  // whitespace to prevent file extension obfuscation on trusted websites
+  // e.g. Gmail might think evil.exe. is safe, so we don't want it to become

[asanka, 2011/08/22 18:01:31]

What about ".evil.exe"?

+  // evil.exe when we download it
+  std::wstring::size_type path_length_before_trim = path.length();
+  TrimWhitespace(path, TRIM_TRAILING, &path);
+  trimmed_trailing_character_count += path_length_before_trim - path.length();
   file_util::ReplaceIllegalCharactersInPath(&path, '-');
+  path.append(trimmed_trailing_character_count, '-');
   FilePath result(path);
   GenerateSafeFileName(mime_type, &result);
   return result.value();
 #else
   std::string path = (filename.empty())? UTF16ToUTF8(default_name) : filename;
   file_util::ReplaceIllegalCharactersInPath(&path, '-');
   FilePath result(path);
   GenerateSafeFileName(mime_type, &result);
   return UTF8ToUTF16(result.value());
 #endif
@@ skipping 921 matching lines @@
 
 NetworkInterface::NetworkInterface(const std::string& name,
                                    const IPAddressNumber& address)
     : name(name), address(address) {
 }
 
 NetworkInterface::~NetworkInterface() {
 }
 
 }  // namespace net