Mark drags starting in web content as tainted to avoid file path forgery

content/browser/web_contents/web_contents_view_aura.cc

Index: content/browser/web_contents/web_contents_view_aura.cc
diff --git a/content/browser/web_contents/web_contents_view_aura.cc b/content/browser/web_contents/web_contents_view_aura.cc
index 361f43c08171978a9702200248ef2f73e5b2ca88..bdb9f2ad8becbd0078b9a59feb213730ef87ab51 100644
--- a/content/browser/web_contents/web_contents_view_aura.cc
+++ b/content/browser/web_contents/web_contents_view_aura.cc
@@ -327,6 +327,7 @@ void PrepareDragForDownload(
 void PrepareDragData(const DropData& drop_data,
                      ui::OSExchangeData::Provider* provider,
                      WebContentsImpl* web_contents) {
+  provider->MarkRendererTainted();
 #if defined(OS_WIN)
   // Put download before file contents to prefer the download of a image over
   // its thumbnail link.
@@ -389,14 +390,16 @@ void PrepareDropData(DropData* drop_data, const ui::OSExchangeData& data) {
   if (html_base_url.is_valid())
     drop_data->html_base_url = html_base_url;
 
-  std::vector<ui::OSExchangeData::FileInfo> files;
-  if (data.GetFilenames(&files) && !files.empty()) {
-    for (std::vector<ui::OSExchangeData::FileInfo>::const_iterator
-             it = files.begin(); it != files.end(); ++it) {
-      drop_data->filenames.push_back(
-          DropData::FileInfo(
-              base::UTF8ToUTF16(it->path.AsUTF8Unsafe()),
-              base::UTF8ToUTF16(it->display_name.AsUTF8Unsafe())));
+  if (!data.IsRendererTainted()) {
+    std::vector<ui::OSExchangeData::FileInfo> files;
+    if (data.GetFilenames(&files) && !files.empty()) {
+      for (std::vector<ui::OSExchangeData::FileInfo>::const_iterator
+               it = files.begin(); it != files.end(); ++it) {
+        drop_data->filenames.push_back(
+            DropData::FileInfo(
+                base::UTF8ToUTF16(it->path.AsUTF8Unsafe()),
+                base::UTF8ToUTF16(it->display_name.AsUTF8Unsafe())));
+      }
     }
   }