Mark drags starting in web content as tainted to avoid file path forgery

ui/base/dragdrop/os_exchange_data.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef UI_BASE_DRAGDROP_OS_EXCHANGE_DATA_H_
 #define UI_BASE_DRAGDROP_OS_EXCHANGE_DATA_H_
 
 #include "build/build_config.h"
 
 #include <set>
@@ skipping 84 matching lines @@
 
   // Provider defines the platform specific part of OSExchangeData that
   // interacts with the native system.
   class UI_BASE_EXPORT Provider {
    public:
     Provider() {}
     virtual ~Provider() {}
 
     virtual Provider* Clone() const = 0;
 
+    virtual void MarkRendererTainted() = 0;
+    virtual bool IsRendererTainted() const = 0;

[tony, 2014/03/21 23:09:00]

Nit: I would name these something more explicit.  E.g.,
MarkOriginateFromRenderer(), DoesOriginateFromRenderer() or something.

[dcheng, 2014/03/21 23:57:07]

Done.

+
     virtual void SetString(const base::string16& data) = 0;
     virtual void SetURL(const GURL& url, const base::string16& title) = 0;
     virtual void SetFilename(const base::FilePath& path) = 0;
     virtual void SetFilenames(
         const std::vector<FileInfo>& file_names) = 0;
     virtual void SetPickledData(const CustomFormat& format,
                                 const Pickle& data) = 0;
 
     virtual bool GetString(base::string16* data) const = 0;
     virtual bool GetURLAndTitle(FilenameToURLPolicy policy,
@@ skipping 41 matching lines @@
   // Creates an OSExchangeData with the specified provider. OSExchangeData
   // takes ownership of the supplied provider.
   explicit OSExchangeData(Provider* provider);
 
   ~OSExchangeData();
 
   // Returns the Provider, which actually stores and manages the data.
   const Provider& provider() const { return *provider_; }
   Provider& provider() { return *provider_; }
 
+  // Marks drag data as tainted if it originates from the renderer. This is used
+  // to avoid granting privileges to a renderer when dragging in tainted data,
+  // since it could allow potential escalation of privileges.
+  void MarkRendererTainted();
+  bool IsRendererTainted() const;
+
   // These functions add data to the OSExchangeData object of various Chrome
   // types. The OSExchangeData object takes care of translating the data into
   // a format suitable for exchange with the OS.
   // NOTE WELL: Typically, a data object like this will contain only one of the
   //            following types of data. In cases where more data is held, the
   //            order in which these functions are called is _important_!
   //       ---> The order types are added to an OSExchangeData object controls
   //            the order of enumeration in our IEnumFORMATETC implementation!
   //            This comes into play when selecting the best (most preferable)
   //            data type for insertion into a DropTarget.
@@ skipping 57 matching lines @@
  private:
   // Provides the actual data.
   scoped_ptr<Provider> provider_;
 
   DISALLOW_COPY_AND_ASSIGN(OSExchangeData);
 };
 
 }  // namespace ui
 
 #endif  // UI_BASE_DRAGDROP_OS_EXCHANGE_DATA_H_