Mark drags starting in web content as tainted to avoid file path forgery

content/browser/web_contents/web_drag_dest_gtk.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_WEB_CONTENTS_WEB_DRAG_DEST_GTK_H_
 #define CONTENT_BROWSER_WEB_CONTENTS_WEB_DRAG_DEST_GTK_H_
 
 #include <gtk/gtk.h>
 
 #include "base/gtest_prod_util.h"
@@ skipping 67 matching lines @@
   // there is no system drag or the system drag is not over our render view.
   GdkDragContext* context_;
 
   // The data for the current drag, or NULL if |context_| is NULL.
   scoped_ptr<DropData> drop_data_;
 
   // The number of outstanding drag data requests we have sent to the drag
   // source.
   int data_requests_;
 
+  // Whether the drag we're currently handling originated from a renderer.
+  bool renderer_tainted_;
+
   // The last time we sent a message to the renderer related to a drag motion.
   gint drag_over_time_;
 
   // Whether the cursor is over a drop target, according to the last message we
   // got from the renderer.
   bool is_drop_target_;
 
   // Stores Handler IDs for the gtk signal handlers. We have to cancel the
   // signal handlers when this WebDragDestGtk is deleted so that if, later on,
   // we re-create the drag dest with the same widget, we don't get callbacks to
   // deleted functions.
   scoped_ptr<int[]> handlers_;
 
   // A delegate that can receive drag information about drag events.
   WebDragDestDelegate* delegate_;
 
   // True if the drag has been canceled.
   bool canceled_;
 
   base::WeakPtrFactory<WebDragDestGtk> method_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(WebDragDestGtk);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_WEB_CONTENTS_WEB_DRAG_DEST_GTK_H_