Mark drags starting in web content as tainted to avoid file path forgery

ui/base/dragdrop/os_exchange_data_provider_aura.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/base/dragdrop/os_exchange_data_provider_aura.h"
 
 #include "base/logging.h"
 #include "base/strings/utf_string_conversions.h"
 #include "net/base/net_util.h"
 #include "ui/base/clipboard/clipboard.h"
@@ skipping 15 matching lines @@
   ret->title_ = title_;
   ret->filenames_ = filenames_;
   ret->pickle_data_ = pickle_data_;
   // We skip copying the drag images.
   ret->html_ = html_;
   ret->base_url_ = base_url_;
 
   return ret;
 }
 
+void OSExchangeDataProviderAura::MarkRendererTainted() {
+  // TODO(dcheng): Currently unneeded because ChromeOS Aura correctly separates
+  // URL and filename metadata, and does not implement the DownloadURL protocol.

[tony, 2014/03/21 23:09:00]

I worry that someone will implement DownloadURL and not know to implement this.

[dcheng, 2014/03/21 23:57:07]

Implementing this breaks dragging and dropping files from the file manager.
Unfortunately, it looks like all the engineers familiar with this bit of the
code are in Tokyo. I'm looking for if there's someway the browser process can
skip the tainting for the file manager (it looks like it's an app), but I'm not
sure what a secure way to do this is yet--presumably, the render process hosting
it can get shared...

+}
+
+bool OSExchangeDataProviderAura::IsRendererTainted() const {
+  return false;
+}
+
 void OSExchangeDataProviderAura::SetString(const base::string16& data) {
   string_ = data;
   formats_ |= OSExchangeData::STRING;
 }
 
 void OSExchangeDataProviderAura::SetURL(const GURL& url,
                                         const base::string16& title) {
   url_ = url;
   title_ = title;
   formats_ |= OSExchangeData::URL;
@@ skipping 146 matching lines @@
 
 ///////////////////////////////////////////////////////////////////////////////
 // OSExchangeData, public:
 
 // static
 OSExchangeData::Provider* OSExchangeData::CreateProvider() {
   return new OSExchangeDataProviderAura();
 }
 
 }  // namespace ui