Ignore suggested download filename for cross origin links.

Source/core/html/HTMLAnchorElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 413 matching lines @@
     ResourceRequest request(completedURL);
     if (prefetchEventHandler()->hasIssuedPreconnect())
         frame->loader().client()->dispatchWillRequestAfterPreconnect(request);
     if (hasAttribute(downloadAttr)) {
         if (!hasRel(RelationNoReferrer)) {
             String referrer = SecurityPolicy::generateReferrerHeader(document().referrerPolicy(), completedURL, document().outgoingReferrer());
             if (!referrer.isEmpty())
                 request.setHTTPReferrer(Referrer(referrer, document().referrerPolicy()));
         }
 
-        frame->loader().client()->loadURLExternally(request, NavigationPolicyDownload, fastGetAttribute(downloadAttr));
+        bool isSameOrigin = document().securityOrigin()->canRequest(completedURL);
+        const AtomicString& suggestedName = (isSameOrigin ? fastGetAttribute(downloadAttr) : nullAtom);
+
+        frame->loader().client()->loadURLExternally(request, NavigationPolicyDownload, suggestedName);

[abarth-chromium, 2014/03/17 18:17:48]

This check doesn't work.  The attacker can use an HTTP redirect to make the
initial URL looks same-origin but have the actual content come from an arbitrary
URL.

You probably need to do this check in the download system after you've followed
the whole redirect chain.

[asanka, 2014/03/17 18:50:24]

Good point! Thanks.

     } else {
         FrameLoadRequest frameRequest(&document(), request, target());
         frameRequest.setTriggeringEvent(event);
         if (hasRel(RelationNoReferrer))
             frameRequest.setShouldSendReferrer(NeverSendReferrer);
         frame->loader().load(frameRequest);
     }
 }
 
 HTMLAnchorElement::EventType HTMLAnchorElement::eventType(Event* event)
@@ skipping 248 matching lines @@
     preconnectToURL(url, motivation);
     m_hasIssuedPreconnect = true;
 }
 
 bool HTMLAnchorElement::isInteractiveContent() const
 {
     return isLink();
 }
 
 }