Neutralize dangerous subresource files during Save Page.

content/browser/download/save_package.cc

Index: content/browser/download/save_package.cc
diff --git a/content/browser/download/save_package.cc b/content/browser/download/save_package.cc
index be50bb467ae67dfd54e89d475f23f1203735051f..5eb4589d13d2ec6ef354435980a43c352b9c0b38 100644
--- a/content/browser/download/save_package.cc
+++ b/content/browser/download/save_package.cc
@@ -401,16 +401,20 @@ bool SavePackage::GenerateFileName(const std::string& disposition,
                                                    kDefaultSaveName);
 
   DCHECK(!file_path.empty());
+  if (need_html_ext)
+    file_path = file_path.ReplaceExtension(kDefaultHtmlExtension);
+
+  DownloadManagerDelegate* delegate = download_manager_->GetDelegate();
+  if (delegate)
+    delegate->SanitizeSaveItemFilename(&file_path);
+
+  DCHECK_EQ(file_path.DirName().value(), base::FilePath::kCurrentDirectory)
+      << "Sanitization shouldn't change containing directory";
+
   base::FilePath::StringType base_name =
       file_path.RemoveExtension().BaseName().value();
   base::FilePath::StringType file_name_ext = file_path.Extension();
 
-  // If it is HTML resource, use ".html" as its extension.
-  if (need_html_ext) {
-    file_name_ext = FILE_PATH_LITERAL(".");
-    file_name_ext.append(kDefaultHtmlExtension);
-  }
-
   // Need to make sure the suggested file name is not too long.
   uint32_t max_path = GetMaxPathLengthForDirectory(saved_main_directory_path_);