Mark drags starting in web content as tainted to avoid file path forgery

ui/base/clipboard/clipboard_aurax11.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/base/clipboard/clipboard.h"
 
 #include <X11/extensions/Xfixes.h>
 #include <X11/Xatom.h>
 #include <list>
 #include <set>
@@ skipping 744 matching lines @@
   ui::AddString16ToVector(title, &data);
   scoped_refptr<base::RefCountedMemory> mem(
       base::RefCountedBytes::TakeVector(&data));
 
   aurax11_details_->InsertMapping(kMimeTypeMozillaURL, mem);
 }
 
 // Write an extra flavor that signifies WebKit was the last to modify the
 // pasteboard. This flavor has no data.
 void Clipboard::WriteWebSmartPaste() {
-  aurax11_details_->InsertMapping(kMimeTypeWebkitSmartPaste,
-                                  scoped_refptr<base::RefCountedMemory>());
+  std::string empty;
+  aurax11_details_->InsertMapping(
+      kMimeTypeWebkitSmartPaste,
+      scoped_refptr<base::RefCountedMemory>(
+          base::RefCountedString::TakeString(&empty)));

[tony, 2014/03/21 23:09:00]

This doesn't seem related to the bug fix.  If you want to include it, mention it
in the change description.

Why do you need to pass the empty string?

[dcheng, 2014/03/21 23:57:07]

It's not directly related. I can pull it out--I did this for consistency, since
this was the code I originally copied in the Aura X11 OSExchangeData::Provider
implementation.

You need to pass something or we unconditionally try to deref the
RefCountedMemory in OnSelectionRequest, which crashes if the pointer is null
like here.

[tony, 2014/03/22 00:15:05]

This is fine, but please mention this in the change description.

 }
 
 void Clipboard::WriteBitmap(const SkBitmap& bitmap) {
   // Encode the bitmap as a PNG for transport.
   std::vector<unsigned char> output;
   if (gfx::PNGCodec::FastEncodeBGRASkBitmap(bitmap, false, &output)) {
     aurax11_details_->InsertMapping(kMimeTypePNG,
                                     base::RefCountedBytes::TakeVector(
                                         &output));
   }
@@ skipping 82 matching lines @@
   return type;
 }
 
 // static
 const Clipboard::FormatType& Clipboard::GetPepperCustomDataFormatType() {
   CR_DEFINE_STATIC_LOCAL(FormatType, type, (kMimeTypePepperCustomData));
   return type;
 }
 
 }  // namespace ui