Neutralize dangerous subresource files during Save Page.

content/browser/download/save_package.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/download/save_package.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 431 matching lines @@
   // TODO(jungshik): Figure out the referrer charset when having one
   // makes sense and pass it to GenerateFileName.
   base::FilePath file_path = net::GenerateFileName(url,
                                                    disposition,
                                                    std::string(),
                                                    std::string(),
                                                    std::string(),
                                                    kDefaultSaveName);
 
   DCHECK(!file_path.empty());
+  if (need_html_ext)
+    file_path = file_path.ReplaceExtension(kDefaultHtmlExtension);

[Nathan Parker, 2016/06/13 21:15:00]

Does this remove the existing extension?  Might the original one be useful to
the user?  I'm not sure.

[asanka, 2016/06/14 21:24:07]

Indeed. Now using .AddExtension() instead.

+
+  download_manager_->GetDelegate()->SanitizeSaveItemFilename(&file_path);
+
+  DCHECK_EQ(file_path.DirName().value(), base::FilePath::kCurrentDirectory)
+      << "Sanitization shouldn't change containing directory";
+
   base::FilePath::StringType base_name =
       file_path.RemoveExtension().BaseName().value();
   base::FilePath::StringType file_name_ext = file_path.Extension();
 
-  // If it is HTML resource, use ".html" as its extension.
-  if (need_html_ext) {
-    file_name_ext = FILE_PATH_LITERAL(".");
-    file_name_ext.append(kDefaultHtmlExtension);
-  }
-
   // Need to make sure the suggested file name is not too long.
   uint32_t max_path = GetMaxPathLengthForDirectory(saved_main_directory_path_);
 
   // Get safe pure file name.
   if (!TruncateBaseNameToFitPathConstraints(
           saved_main_directory_path_, file_name_ext, max_path, &base_name))
     return false;
 
   base::FilePath::StringType file_name = base_name + file_name_ext;
 
@@ skipping 1036 matching lines @@
 }
 
 void SavePackage::FinalizeDownloadEntry() {
   DCHECK(download_);
 
   download_manager_->OnSavePackageSuccessfullyFinished(download_);
   RemoveObservers();
 }
 
 }  // namespace content