Resource requests from Save-Page-As should go through CanRequestURL checks.

content/browser/download/save_file_resource_handler.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_DOWNLOAD_SAVE_FILE_RESOURCE_HANDLER_H_
 #define CONTENT_BROWSER_DOWNLOAD_SAVE_FILE_RESOURCE_HANDLER_H_
 
 #include <stdint.h>
 
 #include <string>
@@ skipping 55 matching lines @@
 
   // If the content-length header is not present (or contains something other
   // than numbers), StringToInt64 returns 0, which indicates 'unknown size' and
   // is handled correctly by the SaveManager.
   void set_content_length(const std::string& content_length);
 
   void set_content_disposition(const std::string& content_disposition) {
     content_disposition_ = content_disposition;
   }
 
+  // Marks the request as unauthorized.
+  //
+  // This has to be called before the request has started.
+  // This will cause the request to be cancelled from OnWillStart callback.
+  //
+  // This way of handling unauthorized requests allows unified handling of all
+  // SaveFile requests - communicating the failure to OnResponseCompleted
+  // happens in a generic, typical way, reusing common infrastructure code
+  // (rather than forcing an ad-hoc, Save-File-specific call to
+  // OnResponseCompleted from ResourceDispatcherHostImpl::BeginSaveFile).
+  void MarkAsUnauthorized();
+
  private:
   SaveItemId save_item_id_;
   SavePackageId save_package_id_;
   int render_process_id_;
   int render_frame_routing_id_;
   scoped_refptr<net::IOBuffer> read_buffer_;
   std::string content_disposition_;
   GURL url_;
   GURL final_url_;
   int64_t content_length_;
   SaveFileManager* save_manager_;
 
+  bool is_authorized_;
+
   static const int kReadBufSize = 32768;  // bytes
 
   DISALLOW_COPY_AND_ASSIGN(SaveFileResourceHandler);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_DOWNLOAD_SAVE_FILE_RESOURCE_HANDLER_H_