Fix an issue that download filename from content disposition is not sanitized

content/browser/android/download_controller_android_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/android/download_controller_android_impl.h"
 
 #include <utility>
 
 #include "base/android/context_utils.h"
 #include "base/android/jni_android.h"
@@ skipping 14 matching lines @@
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/download_url_parameters.h"
 #include "content/public/browser/global_request_id.h"
 #include "content/public/browser/resource_request_info.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/referrer.h"
 #include "jni/DownloadController_jni.h"
+#include "net/base/filename_util.h"
 #include "net/cookies/cookie_options.h"
 #include "net/cookies/cookie_store.h"
 #include "net/http/http_content_disposition.h"
 #include "net/http/http_request_headers.h"
 #include "net/http/http_response_headers.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context.h"
 
 using base::android::ConvertUTF8ToJavaString;
 using base::android::ScopedJavaLocalRef;
@@ skipping 159 matching lines @@
   }
 
   JNIEnv* env = base::android::AttachCurrentThread();
   // Make copy on the heap so we can pass the pointer through JNI.
   intptr_t callback_id = reinterpret_cast<intptr_t>(
       new DownloadControllerAndroid::AcquireFileAccessPermissionCallback(cb));
   Java_DownloadController_requestFileAccess(
       env, GetJavaObject()->Controller(env).obj(), view.obj(), callback_id);
 }
 
+void DownloadControllerAndroidImpl::SetDefaultDownloadFileName(
+    const std::string& file_name) {
+  default_file_name_ = file_name;
+}
+
 bool DownloadControllerAndroidImpl::HasFileAccessPermission(
     ScopedJavaLocalRef<jobject> j_content_view_core) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(!j_content_view_core.is_null());
 
   JNIEnv* env = base::android::AttachCurrentThread();
   return Java_DownloadController_hasFileAccess(
       env, GetJavaObject()->Controller(env).obj(), j_content_view_core.obj());
 }
 
@@ skipping 157 matching lines @@
       ConvertUTF8ToJavaString(env, info.user_agent);
   ScopedJavaLocalRef<jstring> jcontent_disposition =
       ConvertUTF8ToJavaString(env, info.content_disposition);
   ScopedJavaLocalRef<jstring> jmime_type =
       ConvertUTF8ToJavaString(env, info.original_mime_type);
   ScopedJavaLocalRef<jstring> jcookie =
       ConvertUTF8ToJavaString(env, info.cookie);
   ScopedJavaLocalRef<jstring> jreferer =
       ConvertUTF8ToJavaString(env, info.referer);
 
-  // Try parsing the content disposition header to get a
-  // explicitly specified filename if available.
-  net::HttpContentDisposition header(info.content_disposition, "");
+  // net::GetSuggestedFilename will fallback to "download" as filename.
   ScopedJavaLocalRef<jstring> jfilename =
-      ConvertUTF8ToJavaString(env, header.filename());
+      base::android::ConvertUTF16ToJavaString(
+          env, net::GetSuggestedFilename(info.url, info.content_disposition,
+                                         std::string(),  // referrer_charset
+                                         std::string(),  // suggested_name
+                                         info.original_mime_type,
+                                         default_file_name_));
 
   Java_DownloadController_newHttpGetDownload(
       env, GetJavaObject()->Controller(env).obj(), view.obj(), jurl.obj(),
       juser_agent.obj(), jcontent_disposition.obj(), jmime_type.obj(),
       jcookie.obj(), jreferer.obj(), info.has_user_gesture, jfilename.obj(),
       info.total_bytes);
 }
 
 void DownloadControllerAndroidImpl::OnDownloadStarted(
     DownloadItem* download_item) {
@@ skipping 166 matching lines @@
   }
 
   const ResourceRequestInfo* info = ResourceRequestInfo::ForRequest(request);
   if (info)
     has_user_gesture = info->HasUserGesture();
 }
 
 DownloadControllerAndroidImpl::DownloadInfoAndroid::~DownloadInfoAndroid() {}
 
 }  // namespace content