Neutralize dangerous subresource files during Save Page.

content/browser/download/save_package.cc

Index: content/browser/download/save_package.cc
diff --git a/content/browser/download/save_package.cc b/content/browser/download/save_package.cc
index a64f3f29176816bc4d4899e683065af34f539aa6..e56badb9ea2807a500c8f658846fc0d4efff574f 100644
--- a/content/browser/download/save_package.cc
+++ b/content/browser/download/save_package.cc
@@ -449,16 +449,18 @@ bool SavePackage::GenerateFileName(const std::string& disposition,
                                                    kDefaultSaveName);
 
   DCHECK(!file_path.empty());
+  if (need_html_ext)
+    file_path = file_path.ReplaceExtension(kDefaultHtmlExtension);

[Nathan Parker, 2016/06/13 21:15:00]

Does this remove the existing extension?  Might the original one be useful to
the user?  I'm not sure.

[asanka, 2016/06/14 21:24:07]

Indeed. Now using .AddExtension() instead.

+
+  download_manager_->GetDelegate()->SanitizeSaveItemFilename(&file_path);
+
+  DCHECK_EQ(file_path.DirName().value(), base::FilePath::kCurrentDirectory)
+      << "Sanitization shouldn't change containing directory";
+
   base::FilePath::StringType base_name =
       file_path.RemoveExtension().BaseName().value();
   base::FilePath::StringType file_name_ext = file_path.Extension();
 
-  // If it is HTML resource, use ".html" as its extension.
-  if (need_html_ext) {
-    file_name_ext = FILE_PATH_LITERAL(".");
-    file_name_ext.append(kDefaultHtmlExtension);
-  }
-
   // Need to make sure the suggested file name is not too long.
   uint32_t max_path = GetMaxPathLengthForDirectory(saved_main_directory_path_);