Neutralize dangerous subresource files during Save Page.

content/public/browser/download_manager_delegate.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_BROWSER_DOWNLOAD_MANAGER_DELEGATE_H_
 #define CONTENT_PUBLIC_BROWSER_DOWNLOAD_MANAGER_DELEGATE_H_
 
 #include <stdint.h>
 
 #include "base/callback.h"
@@ skipping 101 matching lines @@
   // Asks the user for the path to save a page. The delegate calls the callback
   // to give the answer.
   virtual void ChooseSavePath(
       WebContents* web_contents,
       const base::FilePath& suggested_path,
       const base::FilePath::StringType& default_extension,
       bool can_save_as_complete,
       const SavePackagePathPickedCallback& callback) {
   }
 
+  // Sanitize a filename that's going to be used for a subresource of a

[jam, 2016/06/16 23:13:06]

should SavePackage be in the method name to make it clear?

looking at the method name now, i wouldn't guess that.

[asanka, 2016/06/21 15:39:38]

Done.

+  // SavePackage.
+  //
+  // If the delegate does nothing, the default filename already populated in
+  // |filename| will be used. Otherwise, the delegate can update |filename| to
+  // the desired filename.
+  //
+  // |filename->DirName()| must be the same both before and after the call.

[jam, 2016/06/16 23:13:06]

why not just pass in a file name that doesn't include directory, and then if
it's changed update the original FilePath object? i.e. seems less error prone
for embedders.

[asanka, 2016/06/21 15:39:38]

Done. This was already the case, but I've commented it to be so and updated the
DCHECK to verify.

+  virtual void SanitizeSaveItemFilename(base::FilePath* filename) {}
+
   // Opens the file associated with this download.
   virtual void OpenDownload(DownloadItem* download) {}
 
   // Shows the download via the OS shell.
   virtual void ShowDownloadInShell(DownloadItem* download) {}
 
   // Checks whether a downloaded file still exists.
   virtual void CheckForFileExistence(
       DownloadItem* download,
       const CheckForFileExistenceCallback& callback) {}
 
   // Return a GUID string used for identifying the application to the
   // system AV function for scanning downloaded files. If an empty
   // or invalid GUID string is returned, no client identification
   // will be given to the AV function.
   virtual std::string ApplicationClientIdForFileScanning() const;
 
  protected:
   virtual ~DownloadManagerDelegate();
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_DOWNLOAD_MANAGER_DELEGATE_H_