Look closer at the components of vfsfilenames that are used filenames.

webkit/common/database/database_identifier.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/common/database/database_identifier.h"
 
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "url/url_canon.h"
 
@@ skipping 40 matching lines @@
                             origin.host(),
                             port,
                             false /* unique */,
                             false /* file */);
 }
 
 // static
 DatabaseIdentifier DatabaseIdentifier::Parse(const std::string& identifier) {
   if (!base::IsStringASCII(identifier))
     return DatabaseIdentifier();
+  if (identifier.find("..") != std::string::npos)
+    return DatabaseIdentifier();
+  char forbidden[] = {'\\', '/', ':' ,'\0'};
+  if (identifier.find_first_of(forbidden, 0, arraysize(forbidden)) !=
+          std::string::npos) {
+    return DatabaseIdentifier();
+  }
 
   size_t first_underscore = identifier.find_first_of('_');
   if (first_underscore == std::string::npos || first_underscore == 0)
     return DatabaseIdentifier();
 
   size_t last_underscore = identifier.find_last_of('_');
   if (last_underscore == std::string::npos ||
       last_underscore == first_underscore ||
       last_underscore == identifier.length() - 1)
     return DatabaseIdentifier();
@@ skipping 58 matching lines @@
   if (is_file_)
     return GURL("file:///");
   if (is_unique_)
     return GURL();
   if (port_ == 0)
     return GURL(scheme_ + "://" + hostname_);
   return GURL(scheme_ + "://" + hostname_ + ":" + base::IntToString(port_));
 }
 
 }  // namespace webkit_database