Mark drags starting in web content as tainted to avoid file path forgery

content/browser/web_contents/web_contents_view_aura.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_view_aura.h"
 
 #include "base/auto_reset.h"
 #include "base/command_line.h"
 #include "base/file_util.h"
 #include "base/metrics/histogram.h"
@@ skipping 309 matching lines @@
   ui::OSExchangeData::DownloadFileInfo file_download(base::FilePath(),
                                                      download_file.get());
   provider->SetDownloadFileInfo(file_download);
 }
 #endif
 
 // Utility to fill a ui::OSExchangeDataProvider object from DropData.
 void PrepareDragData(const DropData& drop_data,
                      ui::OSExchangeData::Provider* provider,
                      WebContentsImpl* web_contents) {
+  provider->MarkRendererTainted();
 #if defined(OS_WIN)
   // Put download before file contents to prefer the download of a image over
   // its thumbnail link.
   if (!drop_data.download_metadata.empty())
     PrepareDragForDownload(drop_data, provider, web_contents);
   // We set the file contents before the URL because the URL also sets file
   // contents (to a .URL shortcut).  We want to prefer file content data over
   // a shortcut so we add it first.
   if (!drop_data.file_contents.empty())
     PrepareDragForFileContents(drop_data, provider);
@@ skipping 42 matching lines @@
   }
 
   base::string16 html;
   GURL html_base_url;
   data.GetHtml(&html, &html_base_url);
   if (!html.empty())
     drop_data->html = base::NullableString16(html, false);
   if (html_base_url.is_valid())
     drop_data->html_base_url = html_base_url;
 
-  std::vector<ui::OSExchangeData::FileInfo> files;
-  if (data.GetFilenames(&files) && !files.empty()) {
-    for (std::vector<ui::OSExchangeData::FileInfo>::const_iterator
-             it = files.begin(); it != files.end(); ++it) {
-      drop_data->filenames.push_back(
-          DropData::FileInfo(
-              base::UTF8ToUTF16(it->path.AsUTF8Unsafe()),
-              base::UTF8ToUTF16(it->display_name.AsUTF8Unsafe())));
+  if (!data.IsRendererTainted()) {
+    std::vector<ui::OSExchangeData::FileInfo> files;
+    if (data.GetFilenames(&files) && !files.empty()) {
+      for (std::vector<ui::OSExchangeData::FileInfo>::const_iterator
+               it = files.begin(); it != files.end(); ++it) {
+        drop_data->filenames.push_back(
+            DropData::FileInfo(
+                base::UTF8ToUTF16(it->path.AsUTF8Unsafe()),
+                base::UTF8ToUTF16(it->display_name.AsUTF8Unsafe())));
+      }
     }
   }
 
   Pickle pickle;
   if (data.GetPickledData(ui::Clipboard::GetWebCustomDataFormatType(), &pickle))
     ui::ReadCustomDataIntoMap(
         pickle.data(), pickle.size(), &drop_data->custom_data);
 }
 
 // Utilities to convert between blink::WebDragOperationsMask and
@@ skipping 1125 matching lines @@
       event.location(),
       gfx::Screen::GetScreenFor(GetNativeView())->GetCursorScreenPoint(),
       ConvertAuraEventFlagsToWebInputEventModifiers(event.flags()));
   if (drag_dest_delegate_)
     drag_dest_delegate_->OnDrop();
   current_drop_data_.reset();
   return ConvertFromWeb(current_drag_op_);
 }
 
 }  // namespace content