Index: content/browser/loader/resource_dispatcher_host_impl.cc |
diff --git a/content/browser/loader/resource_dispatcher_host_impl.cc b/content/browser/loader/resource_dispatcher_host_impl.cc |
index fb12a9b95407a2d9276c7bbe9279646f22f837d8..d4c14cb0e7a84f46b939238be10b8a07b2fb5661 100644 |
--- a/content/browser/loader/resource_dispatcher_host_impl.cc |
+++ b/content/browser/loader/resource_dispatcher_host_impl.cc |
@@ -1887,6 +1887,17 @@ void ResourceDispatcherHostImpl::BeginSaveFile(const GURL& url, |
request.get(), save_item_id, save_package_id, child_id, |
render_frame_route_id, url, save_file_manager_.get())); |
+ // Check if the renderer is permitted to request the requested URL. |
+ if (!ChildProcessSecurityPolicyImpl::GetInstance()->CanRequestURL(child_id, |
+ url)) { |
+ VLOG(1) << "Denied unauthorized save of " << url.possibly_invalid_spec(); |
Randy Smith (Not in Mondays)
2016/07/21 19:29:54
Reasonable to make this a DVLOG? I don't think th
Łukasz Anforowicz
2016/07/21 23:44:30
Done.
Note that we have a VLOG for other similar
|
+ handler->OnResponseCompleted( |
+ net::URLRequestStatus::FromError(net::ERR_ACCESS_DENIED), |
+ "", // |security_info|; ignored by SaveFileResourceHandler. |
+ nullptr); // |defer|; ignored by SaveFileResourceHandler. |
mmenke
2016/07/21 19:38:43
This seems kind of hideous. ResourceDispatcherHos
Randy Smith (Not in Mondays)
2016/07/21 19:52:53
You're right. Mea culpa.
(Mind you, this is a st
Łukasz Anforowicz
2016/07/21 23:44:30
Thanks for raising this up. I thought that it mig
mmenke
2016/07/22 00:12:16
The method is inherited from content::ResourceHand
|
+ return; |
+ } |
+ |
BeginRequestInternal(std::move(request), std::move(handler)); |
} |