Use better fallback URLs when calling AVScanFile().

content/browser/download/quarantine_win.cc

Index: content/browser/download/quarantine_win.cc
diff --git a/content/browser/download/quarantine_win.cc b/content/browser/download/quarantine_win.cc
index e478ed3a480691dfd81f214a8bc963686217a930..f3150f002fcfc2faf56d6d1d1cca92d079229f3a 100644
--- a/content/browser/download/quarantine_win.cc
+++ b/content/browser/download/quarantine_win.cc
@@ -155,13 +155,16 @@ QuarantineFileResult SetInternetZoneIdentifierDirectly(
 // |full_path| : is the path to the downloaded file. This should be the final
 //               path of the download. Must be present.
 // |source_url|: the source URL for the download. If empty, the source will
-//               not be set.
+//               be set to 'about:internet'.
+// |referrer_url|: the referrer URL for the download. If empty, the referrer
+//               will not be set.
 // |client_guid|: the GUID to be set in the IAttachmentExecute client slot.
 //                Used to identify the app to the system AV function.
 //                If GUID_NULL is passed, no client GUID is set.
 // |save_result|: Receives the result of invoking IAttachmentExecute::Save().
 bool InvokeAttachmentServices(const base::FilePath& full_path,
                               const std::string& source_url,
+                              const std::string& referrer_url,
                               const GUID& client_guid,
                               HRESULT* save_result) {
   base::win::ScopedComPtr<IAttachmentExecute> attachment_services;
@@ -190,16 +193,21 @@ bool InvokeAttachmentServices(const base::FilePath& full_path,
     return false;
   }
 
-  // Note: SetSource looks like it needs to be called, even if empty.
-  // Docs say it is optional, but it appears not calling it at all sets
-  // a zone that is too restrictive.
-  hr = attachment_services->SetSource(base::UTF8ToWide(source_url).c_str());
+  hr = attachment_services->SetSource(
+      source_url.empty() ? L"about:internet"
+                         : base::UTF8ToWide(source_url).c_str());
   if (FAILED(hr)) {
     RecordAttachmentServicesResult(
         AttachmentServicesResult::FAILED_TO_SET_PARAMETER);
     return false;
   }
 
+  // Only set referrer if one is present. Also, the source_url is authoritative
+  // for determining the relative danger of |full_path|. So not going to
+  // consider it fatal if setting the referrer fails.
+  if (!referrer_url.empty())
+    attachment_services->SetReferrer(base::UTF8ToWide(referrer_url).c_str());
+
   {
     // This method has been known to take longer than 10 seconds in some
     // instances.