Resource requests from Save-Page-As should go through CanRequestURL checks.

content/browser/download/save_file_resource_handler.h

Index: content/browser/download/save_file_resource_handler.h
diff --git a/content/browser/download/save_file_resource_handler.h b/content/browser/download/save_file_resource_handler.h
index 2ab8b2f7f5f54a46b0f2861a44409eca806f12e0..e2b0c9cbe5d3fc33e0c8cb872923dcbb46077d2a 100644
--- a/content/browser/download/save_file_resource_handler.h
+++ b/content/browser/download/save_file_resource_handler.h
@@ -73,6 +73,8 @@ class SaveFileResourceHandler : public ResourceHandler {
     content_disposition_ = content_disposition;
   }
 
+  void MarkAsUnauthorized() { is_authorized_ = false; }

[mmenke, 2016/07/27 14:45:18]

optional:  Could add a comment either here or maybe better, to the RDH about why
we set up everything as normal except this bit when the request isn't
authorized.

[mmenke, 2016/07/27 14:45:18]

optional suggestion:  To be really paranoid about this, could take this in the
constructor as an enum class object.

This forces the caller to explicitly declare if something is authorized whenver
using this class.  Yes, only used in one place, but I'm paranoid.

+
  private:
   SaveItemId save_item_id_;
   SavePackageId save_package_id_;
@@ -85,6 +87,8 @@ class SaveFileResourceHandler : public ResourceHandler {
   int64_t content_length_;
   SaveFileManager* save_manager_;
 
+  bool is_authorized_;
+
   static const int kReadBufSize = 32768;  // bytes
 
   DISALLOW_COPY_AND_ASSIGN(SaveFileResourceHandler);