Prevent web content from forging File entries in drag and drop.

Source/core/page/DragData.cpp

 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2013 Google Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 51 matching lines @@
 }
 
 static bool containsHTML(const DataObject* dropData)
 {
     return dropData->types().contains(mimeTypeTextHTML);
 }
 
 bool DragData::containsURL(FilenameConversionPolicy filenamePolicy) const
 {
     return m_platformDragData->types().contains(mimeTypeTextURIList)
-        || (filenamePolicy == ConvertFilenames && m_platformDragData->containsFilenames());
+        || (filenamePolicy == ConvertFilenames
+            && (m_platformDragData->containsFilenames() || !m_platformDragData->filenameForNavigation().isEmpty()));

[kinuko, 2014/03/11 13:09:31]

nit: feels this condition is a bit hard to read... maybe could be split into
multiple if?

 }
 
 String DragData::asURL(FilenameConversionPolicy filenamePolicy, String* title) const
 {
     String url;
-    if (m_platformDragData->types().contains(mimeTypeTextURIList))
+    if (m_platformDragData->types().contains(mimeTypeTextURIList)) {
         m_platformDragData->urlAndTitle(url, title);
-    else if (filenamePolicy == ConvertFilenames && containsFiles())
-        url = filePathToURL(m_platformDragData->filenames()[0]);
+    } else if (filenamePolicy == ConvertFilenames) {
+        if (containsFiles())
+            url = filePathToURL(m_platformDragData->filenames()[0]);
+        else
+            url = filePathToURL(m_platformDragData->filenameForNavigation());
+    }
     return url;
 }
 
 bool DragData::containsFiles() const
 {
     return m_platformDragData->containsFilenames();
 }
 
 unsigned DragData::numberOfFiles() const
 {
@@ skipping 71 matching lines @@
 
 String DragData::droppedFileSystemId() const
 {
     DraggedIsolatedFileSystem* filesystem = DraggedIsolatedFileSystem::from(m_platformDragData);
     if (!filesystem)
         return String();
     return filesystem->filesystemId();
 }
 
 } // namespace WebCore