Update the child process security policy to use explicit permission grants.

content/browser/renderer_host/render_view_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_view_host_impl.h"
 
 #include <set>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 816 matching lines @@
   RenderWidgetHostImpl::LostMouseLock();
   delegate_->LostMouseLock();
 }
 
 void RenderViewHostImpl::SetInitialFocus(bool reverse) {
   Send(new ViewMsg_SetInitialFocus(GetRoutingID(), reverse));
 }
 
 void RenderViewHostImpl::FilesSelectedInChooser(
     const std::vector<ui::SelectedFileInfo>& files,
-    int permissions) {
+    RenderViewHost::FileSelectionPermissions permissions) {
   // Grant the security access requested to the given files.
   for (size_t i = 0; i < files.size(); ++i) {
     const ui::SelectedFileInfo& file = files[i];
-    ChildProcessSecurityPolicyImpl::GetInstance()->GrantPermissionsForFile(
-        GetProcess()->GetID(), file.local_path, permissions);
+    if (permissions == RenderViewHost::FILE_PERMISSION_READ_ONLY) {
+      ChildProcessSecurityPolicyImpl::GetInstance()->GrantReadFile(
+          GetProcess()->GetID(), file.local_path);
+    }
+    if (permissions == RenderViewHost::FILE_PERMISSION_WRITE) {

[Tom Sepez, 2013/07/09 18:52:50]

nit: else if

[Greg Billock, 2013/07/09 21:09:50]

Done.

+      ChildProcessSecurityPolicyImpl::GetInstance()->GrantCreateWriteFile(
+          GetProcess()->GetID(), file.local_path);
+    }
   }
   Send(new ViewMsg_RunFileChooserResponse(GetRoutingID(), files));
 }
 
 void RenderViewHostImpl::DirectoryEnumerationFinished(
     int request_id,
     const std::vector<base::FilePath>& files) {
   // Grant the security access requested to the given files.
   for (std::vector<base::FilePath>::const_iterator file = files.begin();
        file != files.end(); ++file) {
@@ skipping 1216 matching lines @@
   const std::vector<base::FilePath>& file_paths = state.GetReferencedFiles();
   for (std::vector<base::FilePath>::const_iterator file = file_paths.begin();
        file != file_paths.end(); ++file) {
     if (!policy->CanReadFile(GetProcess()->GetID(), *file))
       return false;
   }
   return true;
 }
 
 }  // namespace content