Mark drags starting in web content as tainted to avoid file path forgery

content/browser/web_contents/web_drag_dest_gtk.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_drag_dest_gtk.h"
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/files/file_path.h"
@@ skipping 103 matching lines @@
     is_drop_target_ = false;
 
     if (delegate())
       delegate()->DragInitialize(web_contents_);
 
     // text/plain must come before text/uri-list. This is a hack that works in
     // conjunction with OnDragDataReceived. Since some file managers populate
     // text/plain with file URLs when dragging files, we want to handle
     // text/uri-list after text/plain so that the plain text can be cleared if
     // it's a file drag.
+    // Similarly, renderer taint must occur before anything else so we can
+    // ignore potentially forged filenames when handling text/uri-list.
     static int supported_targets[] = {
+      ui::RENDERER_TAINT,
       ui::TEXT_PLAIN,
       ui::TEXT_URI_LIST,
       ui::TEXT_HTML,
       ui::NETSCAPE_URL,
       ui::CHROME_NAMED_URL,
       // TODO(estade): support image drags?
       ui::CUSTOM_DATA,
     };
 
     // Add the delegate's requested target if applicable. Need to do this here
@@ skipping 40 matching lines @@
 
   data_requests_--;
 
   // Decode the data.
   gint data_length = gtk_selection_data_get_length(data);
   const guchar* raw_data = gtk_selection_data_get_data(data);
   GdkAtom target = gtk_selection_data_get_target(data);
   if (raw_data && data_length > 0) {
     // If the source can't provide us with valid data for a requested target,
     // raw_data will be NULL.
-    if (target == ui::GetAtomForTarget(ui::TEXT_PLAIN)) {
+    if (target == ui::GetAtomForTarget(ui::RENDERER_TAINT)) {
+      drop_data_->did_originate_from_renderer = true;
+    } else if (target == ui::GetAtomForTarget(ui::TEXT_PLAIN)) {
       guchar* text = gtk_selection_data_get_text(data);
       if (text) {
         drop_data_->text = base::NullableString16(
             base::UTF8ToUTF16(std::string(reinterpret_cast<const char*>(text))),
             false);
         g_free(text);
       }
     } else if (target == ui::GetAtomForTarget(ui::TEXT_URI_LIST)) {
       gchar** uris = gtk_selection_data_get_uris(data);
       if (uris) {
@@ skipping 136 matching lines @@
   gtk_drag_finish(context, is_drop_target_, FALSE, time);
 
   return TRUE;
 }
 
 RenderViewHostImpl* WebDragDestGtk::GetRenderViewHost() const {
   return static_cast<RenderViewHostImpl*>(web_contents_->GetRenderViewHost());
 }
 
 }  // namespace content