Mark drags starting in web content as tainted to avoid file path forgery

content/browser/web_contents/web_drag_source_gtk.cc

Index: content/browser/web_contents/web_drag_source_gtk.cc
diff --git a/content/browser/web_contents/web_drag_source_gtk.cc b/content/browser/web_contents/web_drag_source_gtk.cc
index a515e23bd5406dd3438dbcaf22b554042ad4929e..68a79f90e0e16a09390fb351a86fc84e0e71cf0b 100644
--- a/content/browser/web_contents/web_drag_source_gtk.cc
+++ b/content/browser/web_contents/web_drag_source_gtk.cc
@@ -79,7 +79,7 @@ bool WebDragSourceGtk::StartDragging(const DropData& drop_data,
     return false;
   }
 
-  int targets_mask = 0;
+  int targets_mask = ui::RENDERER_TAINT;
 
   if (!drop_data.text.string().empty())
     targets_mask |= ui::TEXT_PLAIN;
@@ -285,6 +285,17 @@ void WebDragSourceGtk::OnDragDataGet(GtkWidget* sender,
       break;
     }
 
+    case ui::RENDERER_TAINT: {
+      static const char kPlaceholder[] = "x";
+      gtk_selection_data_set(
+          selection_data,
+          ui::GetAtomForTarget(ui::RENDERER_TAINT),
+          kBitsPerByte,
+          reinterpret_cast<const guchar*>(kPlaceholder),
+          strlen(kPlaceholder));
+      break;
+    }
+
     default:
       NOTREACHED();
   }