Check that the files the renderer wants to preserve as part of a session restore are already availa…

content/browser/renderer_host/render_view_host_impl.cc

Index: content/browser/renderer_host/render_view_host_impl.cc
diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
index 8424da94d3255969f6fa9e015b0b8424ea5d5856..14fa4381af61b7602cdc4131499df037845ab1ea 100644
--- a/content/browser/renderer_host/render_view_host_impl.cc
+++ b/content/browser/renderer_host/render_view_host_impl.cc
@@ -67,6 +67,7 @@
 #include "ui/shell_dialogs/selected_file_info.h"
 #include "ui/snapshot/snapshot.h"
 #include "webkit/fileapi/isolated_context.h"
+#include "webkit/glue/glue_serialize.h"
 #include "webkit/glue/webdropdata.h"
 #include "webkit/glue/webkit_glue.h"
 
@@ -1224,14 +1225,40 @@ void RenderViewHostImpl::OnNavigate(const IPC::Message& msg) {
   FilterURL(policy, process, true, &validated_params.password_form.origin);
   FilterURL(policy, process, true, &validated_params.password_form.action);
 
+  // Without this check, the renderer can trick the browser into using
+  // filenames it can't access in a future session restore.
+  if (!CanAccessFilesOfSerializedState(validated_params.content_state))
+    return;
+
   delegate_->DidNavigate(this, validated_params);
 }
 
 void RenderViewHostImpl::OnUpdateState(int32 page_id,
                                        const std::string& state) {
+  // Without this check, the renderer can trick the browser into using
+  // filenames it can't access in a future session restore.
+  if (!CanAccessFilesOfSerializedState(state))
+    return;
+
   delegate_->UpdateState(this, page_id, state);
 }
 
+bool RenderViewHostImpl::CanAccessFilesOfSerializedState(

[darin (slow to review), 2013/05/02 22:15:35]

nit: this method should be listed after the ClearPowerSaveBlockers method to
preserve sort order of methods in the header file.

+    const std::string& state) const {
+  ChildProcessSecurityPolicyImpl* policy =
+      ChildProcessSecurityPolicyImpl::GetInstance();
+  const std::vector<base::FilePath>& file_paths =
+      webkit_glue::FilePathsFromHistoryState(state);
+  for (std::vector<base::FilePath>::const_iterator file = file_paths.begin();
+       file != file_paths.end(); ++file) {
+    if (!policy->CanReadFile(GetProcess()->GetID(), *file)) {
+      NOTREACHED() << "Never accept serialized files the renderer can't read.";
+      return false;
+    }
+  }
+  return true;
+}
+
 void RenderViewHostImpl::OnUpdateTitle(
     int32 page_id,
     const string16& title,