Neutralize dangerous subresource files during Save Page.

content/public/browser/download_manager_delegate.h

Index: content/public/browser/download_manager_delegate.h
diff --git a/content/public/browser/download_manager_delegate.h b/content/public/browser/download_manager_delegate.h
index 13b395721c7d6b7cef81f083a95beb3d38004a04..bf68f15801a930637a88df2a40c9ff299aebd8db 100644
--- a/content/public/browser/download_manager_delegate.h
+++ b/content/public/browser/download_manager_delegate.h
@@ -119,6 +119,16 @@ class CONTENT_EXPORT DownloadManagerDelegate {
       const SavePackagePathPickedCallback& callback) {
   }
 
+  // Sanitize a filename that's going to be used for a subresource of a

[jam, 2016/06/16 23:13:06]

should SavePackage be in the method name to make it clear?

looking at the method name now, i wouldn't guess that.

[asanka, 2016/06/21 15:39:38]

Done.

+  // SavePackage.
+  //
+  // If the delegate does nothing, the default filename already populated in
+  // |filename| will be used. Otherwise, the delegate can update |filename| to
+  // the desired filename.
+  //
+  // |filename->DirName()| must be the same both before and after the call.

[jam, 2016/06/16 23:13:06]

why not just pass in a file name that doesn't include directory, and then if
it's changed update the original FilePath object? i.e. seems less error prone
for embedders.

[asanka, 2016/06/21 15:39:38]

Done. This was already the case, but I've commented it to be so and updated the
DCHECK to verify.

+  virtual void SanitizeSaveItemFilename(base::FilePath* filename) {}
+
   // Opens the file associated with this download.
   virtual void OpenDownload(DownloadItem* download) {}