Resource requests from Save-Page-As should go through CanRequestURL checks.

content/browser/download/save_file_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "build/build_config.h"
 
 #include "content/browser/download/save_file_manager.h"
 
 #include "base/bind.h"
 #include "base/files/file_util.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "base/threading/thread.h"
 #include "content/browser/download/save_file.h"
 #include "content/browser/download/save_package.h"
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
-#include "net/base/filename_util.h"
 #include "net/base/io_buffer.h"
 #include "url/gurl.h"
 
 namespace content {
 
 SaveFileManager::SaveFileManager() {}
 
 SaveFileManager::~SaveFileManager() {
   // Check for clean shutdown.
   DCHECK(save_file_map_.empty());
@@ skipping 284 matching lines @@
               save_file->render_process_id(), save_file->request_id()));
     }
 
     // Whatever the save file is complete or not, just delete it.  This
     // will delete the underlying file if InProgress() is true.
     save_file_map_.erase(it);
     delete save_file;
   }
 }
 
-// It is possible that SaveItem which has specified save_item_id has been
-// canceled
-// before this function runs. So if we can not find corresponding SaveFile by
-// using specified save_item_id, just return.
-void SaveFileManager::SaveLocalFile(const GURL& original_file_url,
-                                    SaveItemId save_item_id,
-                                    SavePackageId save_package_id) {
-  DCHECK_CURRENTLY_ON(BrowserThread::FILE);
-  SaveFile* save_file = LookupSaveFile(save_item_id);
-  if (!save_file)
-    return;
-  // If it has finished, just return.
-  if (!save_file->InProgress())
-    return;
-
-  // Close the save file before the copy operation.
-  save_file->Finish();
-  save_file->Detach();
-
-  DCHECK(original_file_url.SchemeIsFile());
-  base::FilePath file_path;
-  net::FileURLToFilePath(original_file_url, &file_path);
-  // If we can not get valid file path from original URL, treat it as
-  // disk error.
-  if (file_path.empty())
-    SaveFinished(save_item_id, save_package_id, false);
-
-  // Copy the local file to the temporary file. It will be renamed to its
-  // final name later.
-  bool success = base::CopyFile(file_path, save_file->FullPath());
-  if (!success)
-    base::DeleteFile(save_file->FullPath(), false);
-  SaveFinished(save_item_id, save_package_id, success);
-}

[Łukasz Anforowicz, 2016/06/18 00:37:20]

The deleted code was added in the "initial commit".

-
 void SaveFileManager::OnDeleteDirectoryOrFile(const base::FilePath& full_path,
                                               bool is_dir) {
   DCHECK_CURRENTLY_ON(BrowserThread::FILE);
   DCHECK(!full_path.empty());
 
   base::DeleteFile(full_path, is_dir);
 }
 
 void SaveFileManager::RenameAllFiles(const FinalNamesMap& final_names,
                                      const base::FilePath& resource_dir,
@@ skipping 47 matching lines @@
       SaveFile* save_file = it->second;
       DCHECK(!save_file->InProgress());
       base::DeleteFile(save_file->FullPath(), false);
       delete save_file;
       save_file_map_.erase(it);
     }
   }
 }
 
 }  // namespace content