Resource requests from Save-Page-As should go through CanRequestURL checks.

content/browser/download/docs/save-page-as.md

 # High-level overview of Save-Page-As code
 
 This document describes code under `//content/browser/downloads`
 restricting the scope only to code handling Save-Page-As functionality
 (i.e. leaving out other downloads-related code).
 This document focuses on high-level overview and aspects of the code that
 span multiple compilation units (hoping that individual compilation units
 are described by their code comments or by their code structure).
 
 ## Classes overview
 
 * SavePackage class
     * coordinates overall save-page-as request
     * created and owned by `WebContents`
       (ref-counted today, but it is unnecessary - see https://crbug.com/596953)
     * UI-thread object
 
 * SaveFileCreateInfo::SaveFileSource enum
-    * classifies `SaveItem` and `SaveFile` processing into 3 flavours:
+    * classifies `SaveItem` and `SaveFile` processing into 2 flavours:
         * `SAVE_FILE_FROM_NET` (see `SaveFileResourceHandler`)
         * `SAVE_FILE_FROM_DOM` (see "Complete HTML" section below)
-        * `SAVE_FILE_FROM_FILE` (see `SaveFileManager::SaveLocalFile`)
 
 * SaveItem class
     * tracks saving a single file
     * created and owned by `SavePackage`
     * UI-thread object
 
 * SaveFileManager class
     * coordinates between FILE and UI threads
         * Gets requests from `SavePackage` and communicates results back to
           `SavePackage` on the UI thread.
@@ skipping 28 matching lines @@
 The flow is different depending on the save format chosen by the user
 (each flow is described in a separate section below).
 
 ### Complete HTML
 
 Very high-level flow of saving a page as "Complete HTML":
 
 * Step 1: `SavePackage` asks all frames for "savable resources"
           and creates `SaveItem` for each of files that need to be saved
 
-* Step 2: `SavePackage` first processes `SAVE_FILE_FROM_NET` and
-          `SAVE_FILE_FROM_FILE` `SaveItem`s and asks `SaveFileManager` to save
+* Step 2: `SavePackage` first processes `SAVE_FILE_FROM_NET`

[Randy Smith (Not in Mondays), 2016/07/21 19:29:54]

Worth changing the enum name now that it's no-longer making a distinction with
local files?

[Łukasz Anforowicz, 2016/07/21 23:44:30]

Maybe.  I cannot think of a better name.  The gist here is that
SAVE_FILE_FROM_NET save items are saved via a new resource request (which can
come from the net, but we hope it will come from in-memory cache).

Some name ideas that I don't like:

- SAVE_FILE_VIA_RESOURCE_REQUEST - it misses "FROM", so seems like a bad name
for a SaveFile*Source* enum.

- SAVE_FILE_FROM_RESOURCE_REQUEST - this seems confusing / I am not sure what it
means to save something "from" a resource request

I think that SAVE_FILE_FROM_NET is okay, even with the changes (because resource
requests are a concept from the //net layer).  WDYT?

+          `SaveItem`s and asks `SaveFileManager` to save
           them.
 
 * Step 3: `SavePackage` handles remaining `SAVE_FILE_FROM_DOM` `SaveItem`s and
           asks each frame to serialize its DOM/HTML (each frame gets from
           `SavePackage` a map covering local paths that need to be referenced by
           the frame).  Responses from frames get forwarded to `SaveFileManager`
           to be written to disk.
 
 
 ### MHTML
@@ skipping 16 matching lines @@
 
 Note: MHTML format is by default disabled in Save-Page-As UI on Windows, MacOS
 and Linux (it is the default on ChromeOS), but for testing this can be easily
 changed using `--save-page-as-mhtml` command line switch.
 
 
 ### HTML Only
 
 Very high-level flow of saving a page as "HTML Only":
 
-* `SavePackage` creates only a single `SaveItem` (either `SAVE_FILE_FROM_NET` or
-  `SAVE_FILE_FROM_FILE`) and asks `SaveFileManager` to process it
+* `SavePackage` creates only a single `SaveItem` (always `SAVE_FILE_FROM_NET`)
+  and asks `SaveFileManager` to process it
   (as in the Complete HTML individual SaveItem handling above.).
 
 
 ## Other relevant code
 
 Pointers to related code outside of `//content/browser/download`:
 
 * End-to-end tests:
     * `//chrome/browser/downloads/save_page_browsertest.cc`
     * `//chrome/test/data/save_page/...`
 
 * Other tests:
     * `//content/browser/downloads/*test*.cc`
     * `//content/renderer/dom_serializer_browsertest.cc` - single process... :-/
 
 * Elsewhere in `//content`:
     * `//content/renderer/savable_resources...`
 
 * Blink:
     * `//third_party/WebKit/public/web/WebFrameSerializer...`
     * `//third_party/WebKit/Source/web/WebFrameSerializerImpl...`
       (used for Complete HTML today;  should use `FrameSerializer` instead in
       the long-term - see https://crbug.com/328354).
     * `//third_party/WebKit/Source/core/frame/FrameSerializer...`
       (used for MHTML today)
     * `//third_party/WebKit/Source/platform/mhtml/MHTMLArchive...`