Prevent web content from forging File entries in drag and drop.

Source/core/page/DragData.cpp

Index: Source/core/page/DragData.cpp
diff --git a/Source/core/page/DragData.cpp b/Source/core/page/DragData.cpp
index 789c462909d69e764111c51ec621de94bdd478c1..5b46ba7e2c9f439783f146f44ae65b09d2b79d6d 100644
--- a/Source/core/page/DragData.cpp
+++ b/Source/core/page/DragData.cpp
@@ -69,16 +69,21 @@ static bool containsHTML(const DataObject* dropData)
 bool DragData::containsURL(FilenameConversionPolicy filenamePolicy) const
 {
     return m_platformDragData->types().contains(mimeTypeTextURIList)
-        || (filenamePolicy == ConvertFilenames && m_platformDragData->containsFilenames());
+        || (filenamePolicy == ConvertFilenames
+            && (m_platformDragData->containsFilenames() || !m_platformDragData->filenameForNavigation().isEmpty()));

[kinuko, 2014/03/11 13:09:31]

nit: feels this condition is a bit hard to read... maybe could be split into
multiple if?

 }
 
 String DragData::asURL(FilenameConversionPolicy filenamePolicy, String* title) const
 {
     String url;
-    if (m_platformDragData->types().contains(mimeTypeTextURIList))
+    if (m_platformDragData->types().contains(mimeTypeTextURIList)) {
         m_platformDragData->urlAndTitle(url, title);
-    else if (filenamePolicy == ConvertFilenames && containsFiles())
-        url = filePathToURL(m_platformDragData->filenames()[0]);
+    } else if (filenamePolicy == ConvertFilenames) {
+        if (containsFiles())
+            url = filePathToURL(m_platformDragData->filenames()[0]);
+        else
+            url = filePathToURL(m_platformDragData->filenameForNavigation());
+    }
     return url;
 }