Mark drags starting in web content as tainted to avoid file path forgery

ui/base/dragdrop/os_exchange_data_provider_aura.cc

Index: ui/base/dragdrop/os_exchange_data_provider_aura.cc
diff --git a/ui/base/dragdrop/os_exchange_data_provider_aura.cc b/ui/base/dragdrop/os_exchange_data_provider_aura.cc
index f98cf9cc0246d520328ebf28c0c9c4297f334e03..dd4a9b654568f766293e6b007f7111a10f7ebec5 100644
--- a/ui/base/dragdrop/os_exchange_data_provider_aura.cc
+++ b/ui/base/dragdrop/os_exchange_data_provider_aura.cc
@@ -33,6 +33,15 @@ OSExchangeData::Provider* OSExchangeDataProviderAura::Clone() const {
   return ret;
 }
 
+void OSExchangeDataProviderAura::MarkRendererTainted() {
+  // TODO(dcheng): Currently unneeded because ChromeOS Aura correctly separates
+  // URL and filename metadata, and does not implement the DownloadURL protocol.

[tony, 2014/03/21 23:09:00]

I worry that someone will implement DownloadURL and not know to implement this.

[dcheng, 2014/03/21 23:57:07]

Implementing this breaks dragging and dropping files from the file manager.
Unfortunately, it looks like all the engineers familiar with this bit of the
code are in Tokyo. I'm looking for if there's someway the browser process can
skip the tainting for the file manager (it looks like it's an app), but I'm not
sure what a secure way to do this is yet--presumably, the render process hosting
it can get shared...

+}
+
+bool OSExchangeDataProviderAura::IsRendererTainted() const {
+  return false;
+}
+
 void OSExchangeDataProviderAura::SetString(const base::string16& data) {
   string_ = data;
   formats_ |= OSExchangeData::STRING;