[SafeBrowsing] Block dangerous unchecked downloads based on a Finch trial.

chrome/browser/file_select_helper.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_FILE_SELECT_HELPER_H_
 #define CHROME_BROWSER_FILE_SELECT_HELPER_H_
 
 #include <map>
 #include <vector>
 
@@ skipping 33 matching lines @@
 
   // Enumerates all the files in directory.
   static void EnumerateDirectory(content::WebContents* tab,
                                  int request_id,
                                  const base::FilePath& path);
 
  private:
   friend class base::RefCountedThreadSafe<FileSelectHelper>;
   FRIEND_TEST_ALL_PREFIXES(FileSelectHelperTest, IsAcceptTypeValid);
   FRIEND_TEST_ALL_PREFIXES(FileSelectHelperTest, ZipPackage);
+  FRIEND_TEST_ALL_PREFIXES(FileSelectHelperTest, GetSanitizedFileName);
   explicit FileSelectHelper(Profile* profile);
   ~FileSelectHelper() override;
 
   // Utility class which can listen for directory lister events and relay
   // them to the main object with the correct tracking id.
   class DirectoryListerDispatchDelegate
       : public net::DirectoryLister::DirectoryListerDelegate {
    public:
     DirectoryListerDispatchDelegate(FileSelectHelper* parent, int id)
         : parent_(parent),
@@ skipping 106 matching lines @@
   // |accept_types| contains only valid lowercased MIME types or file extensions
   // beginning with a period (.).
   static scoped_ptr<ui::SelectFileDialog::FileTypeInfo>
       GetFileTypesFromAcceptType(
           const std::vector<base::string16>& accept_types);
 
   // Check the accept type is valid. It is expected to be all lower case with
   // no whitespace.
   static bool IsAcceptTypeValid(const std::string& accept_type);
 
+  // Get a sanitized filename suitable for use as a default filename. The
+  // suggested filename coming over the IPC may contain invalid characters or
+  // may result in a filename that's reserved on the current platform.
+  //
+  // If |suggested_path| is empty, the return value is also empty.
+  //
+  // If |suggested_path| is non-empty, but can't be safely converted to UTF-8,
+  // or is entirely lost during the sanitization process (e.g. because it
+  // consists entirely of invalid characters), it's replaced with a default
+  // filename.
+  //
+  // Otherwise, returns |suggested_path| with any invalid characters will be
+  // replaced with a suitable replacement character.
+  static base::FilePath GetSanitizedFileName(
+      const base::FilePath& suggested_path);
+
   // Profile used to set/retrieve the last used directory.
   Profile* profile_;
 
   // The RenderViewHost and WebContents for the page showing a file dialog
   // (may only be one such dialog).
   content::RenderViewHost* render_view_host_;
   content::WebContents* web_contents_;
 
   // Dialog box used for choosing files to upload from file form fields.
   scoped_refptr<ui::SelectFileDialog> select_file_dialog_;
@@ skipping 15 matching lines @@
   content::NotificationRegistrar notification_registrar_;
 
   // Temporary files only used on OSX. This class is responsible for deleting
   // these files when they are no longer needed.
   std::vector<base::FilePath> temporary_files_;
 
   DISALLOW_COPY_AND_ASSIGN(FileSelectHelper);
 };
 
 #endif  // CHROME_BROWSER_FILE_SELECT_HELPER_H_