Mark drags starting in web content as tainted to avoid file path forgery

content/browser/web_contents/web_drag_source_gtk.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_drag_source_gtk.h"
 
 #include <string>
 
 #include "base/nix/mime_util_xdg.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 61 matching lines @@
                                      WebDragOperationsMask allowed_ops,
                                      GdkEventButton* last_mouse_down,
                                      const SkBitmap& image,
                                      const gfx::Vector2d& image_offset) {
   // Guard against re-starting before previous drag completed.
   if (drag_context_) {
     NOTREACHED();
     return false;
   }
 
-  int targets_mask = 0;
+  int targets_mask = ui::RENDERER_TAINT;
 
   if (!drop_data.text.string().empty())
     targets_mask |= ui::TEXT_PLAIN;
   if (drop_data.url.is_valid()) {
     targets_mask |= ui::TEXT_URI_LIST;
     targets_mask |= ui::CHROME_NAMED_URL;
     targets_mask |= ui::NETSCAPE_URL;
   }
   if (!drop_data.html.string().empty())
     targets_mask |= ui::TEXT_HTML;
@@ skipping 185 matching lines @@
       ui::WriteCustomDataToPickle(drop_data_->custom_data, &custom_data);
       gtk_selection_data_set(
           selection_data,
           ui::GetAtomForTarget(ui::CUSTOM_DATA),
           kBitsPerByte,
           reinterpret_cast<const guchar*>(custom_data.data()),
           custom_data.size());
       break;
     }
 
+    case ui::RENDERER_TAINT: {
+      static const char kPlaceholder[] = "x";
+      gtk_selection_data_set(
+          selection_data,
+          ui::GetAtomForTarget(ui::RENDERER_TAINT),
+          kBitsPerByte,
+          reinterpret_cast<const guchar*>(kPlaceholder),
+          strlen(kPlaceholder));
+      break;
+    }
+
     default:
       NOTREACHED();
   }
 }
 
 gboolean WebDragSourceGtk::OnDragFailed(GtkWidget* sender,
                                         GdkDragContext* context,
                                         GtkDragResult result) {
   drag_failed_ = true;
 
@@ skipping 96 matching lines @@
   cairo_clip(cr);
   cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
   gdk_cairo_set_source_pixbuf(cr, drag_pixbuf_, 0, 0);
   cairo_paint(cr);
   cairo_destroy(cr);
 
   return TRUE;
 }
 
 }  // namespace content