Prevent web content from forging File entries in drag and drop.

Source/core/clipboard/DataObject.h

 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 73 matching lines @@
     bool containsFilenames() const;
     Vector<String> filenames() const;
     void addFilename(const String& filename, const String& displayName);
 
     // Used to handle files (images) being dragged out.
     void addSharedBuffer(const String& name, PassRefPtr<SharedBuffer>);
 
     int modifierKeyState() const { return m_modifierKeyState; }
     void setModifierKeyState(int modifierKeyState) { m_modifierKeyState = modifierKeyState; }
 
+    // The accessor should only ever be called by DragData.
+    const String& filenameForNavigation() const { return m_filenameForNavigation; }
+    void setFilenameForNavigation(const String& filename) { m_filenameForNavigation = filename; }
+
     // FIXME: oilpan: This trace() has to trace Supplementable.
     void trace(Visitor*);
 
 private:
     DataObject();
     explicit DataObject(const DataObject&);
 
     PassRefPtrWillBeRawPtr<DataObjectItem> findStringItem(const String& type) const;
     bool internalAddStringItem(PassRefPtrWillBeRawPtr<DataObjectItem>);
     void internalAddFileItem(PassRefPtrWillBeRawPtr<DataObjectItem>);
 
     WillBeHeapVector<RefPtrWillBeMember<DataObjectItem> > m_itemList;
 
+    String m_filenameForNavigation;
+
     // State of Shift/Ctrl/Alt/Meta keys.
     int m_modifierKeyState;
 };
 
 } // namespace WebCore
 
 #endif