Neutralize dangerous subresource files during Save Page.

chrome/browser/download/save_page_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 #include <stdint.h>
 #include <string>
 #include <utility>
 #include <vector>
 
@@ skipping 744 matching lines @@
   loop_runner->Run();
   base::FilePath download_dir = DownloadPrefs::FromDownloadManager(
       GetDownloadManager())->DownloadPath();
   base::FilePath filename = download_dir.AppendASCII("dataurl.txt");
   ASSERT_TRUE(base::PathExists(filename));
   std::string contents;
   EXPECT_TRUE(base::ReadFileToString(filename, &contents));
   EXPECT_EQ("foo", contents);
 }
 
+// If a save-page-complete operation results in creating subresources that would
+// otherwise be considered dangerous, such files should get a .download
+// extension appended so that they won't be accidentally executed by the user.
+IN_PROC_BROWSER_TEST_F(SavePageBrowserTest, DangerousSubresources) {
+  GURL url =
+      URLRequestMockHTTPJob::GetMockUrl("/save_page/dubious-subresources.html");
+
+  ui_test_utils::NavigateToURL(browser(), url);
+  base::FilePath full_file_name, dir;
+  SaveCurrentTab(url, content::SAVE_PAGE_TYPE_AS_COMPLETE_HTML,
+                 "dubious-subresources", 2, &dir, &full_file_name);
+  ASSERT_FALSE(HasFailure());
+
+  EXPECT_TRUE(base::PathExists(full_file_name));
+  EXPECT_TRUE(base::PathExists(dir.AppendASCII("not-a-crx.crx.download")));
+}
+
 // Test that we don't crash when the page contains an iframe that
 // was handled as a download (http://crbug.com/42212).
 IN_PROC_BROWSER_TEST_F(SavePageBrowserTest, SaveDownloadableIFrame) {
   GURL url = URLRequestMockHTTPJob::GetMockUrl(
       "downloads/iframe-src-is-a-download.htm");
 
   // Wait for and then dismiss the non-save-page-as-related download item
   // (the one associated with downloading of "thisdayinhistory.xls" file).
   {
     GURL download_url("http://mock.http/downloads/thisdayinhistory.xls");
@@ skipping 463 matching lines @@
   TestOriginalVsSavedPage(save_page_type, url, 1, expected_substrings);
 }
 
 INSTANTIATE_TEST_CASE_P(
     SaveType,
     SavePageOriginalVsSavedComparisonTest,
     ::testing::Values(content::SAVE_PAGE_TYPE_AS_COMPLETE_HTML,
                       content::SAVE_PAGE_TYPE_AS_MHTML));
 
 }  // namespace