Resource requests from Save-Page-As should go through CanRequestURL checks.

content/browser/download/save_file_resource_handler.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_DOWNLOAD_SAVE_FILE_RESOURCE_HANDLER_H_
 #define CONTENT_BROWSER_DOWNLOAD_SAVE_FILE_RESOURCE_HANDLER_H_
 
 #include <stdint.h>
 
 #include <string>
@@ skipping 55 matching lines @@
 
   // If the content-length header is not present (or contains something other
   // than numbers), StringToInt64 returns 0, which indicates 'unknown size' and
   // is handled correctly by the SaveManager.
   void set_content_length(const std::string& content_length);
 
   void set_content_disposition(const std::string& content_disposition) {
     content_disposition_ = content_disposition;
   }
 
+  void MarkAsUnauthorized() { is_authorized_ = false; }

[mmenke, 2016/07/27 14:45:18]

optional:  Could add a comment either here or maybe better, to the RDH about why
we set up everything as normal except this bit when the request isn't
authorized.

[mmenke, 2016/07/27 14:45:18]

optional suggestion:  To be really paranoid about this, could take this in the
constructor as an enum class object.

This forces the caller to explicitly declare if something is authorized whenver
using this class.  Yes, only used in one place, but I'm paranoid.

+
  private:
   SaveItemId save_item_id_;
   SavePackageId save_package_id_;
   int render_process_id_;
   int render_frame_routing_id_;
   scoped_refptr<net::IOBuffer> read_buffer_;
   std::string content_disposition_;
   GURL url_;
   GURL final_url_;
   int64_t content_length_;
   SaveFileManager* save_manager_;
 
+  bool is_authorized_;
+
   static const int kReadBufSize = 32768;  // bytes
 
   DISALLOW_COPY_AND_ASSIGN(SaveFileResourceHandler);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_DOWNLOAD_SAVE_FILE_RESOURCE_HANDLER_H_