Resource requests from Save-Page-As should go through CanRequestURL checks.

content/browser/download/save_file_resource_handler.cc

Index: content/browser/download/save_file_resource_handler.cc
diff --git a/content/browser/download/save_file_resource_handler.cc b/content/browser/download/save_file_resource_handler.cc
index 969e2db48052e32ebb5b615d27748ecb79373883..9a1078a23a1895ed61d0821d72117390b55eef03 100644
--- a/content/browser/download/save_file_resource_handler.cc
+++ b/content/browser/download/save_file_resource_handler.cc
@@ -30,7 +30,8 @@ SaveFileResourceHandler::SaveFileResourceHandler(net::URLRequest* request,
       render_frame_routing_id_(render_frame_routing_id),
       url_(url),
       content_length_(0),
-      save_manager_(manager) {}
+      save_manager_(manager),
+      is_authorized_(true) {}
 
 SaveFileResourceHandler::~SaveFileResourceHandler() {
 }
@@ -56,13 +57,21 @@ bool SaveFileResourceHandler::OnResponseStarted(ResourceResponse* response,
   return true;
 }
 
+void SaveFileResourceHandler::MarkAsUnauthorized() {
+  // MarkAsUnauthorized has to be called before the request has started.
+  DCHECK(!request()->is_pending());
+
+  is_authorized_ = false;
+}
+
 bool SaveFileResourceHandler::OnWillStart(const GURL& url, bool* defer) {
-  return true;
+  return is_authorized_;
 }
 
 bool SaveFileResourceHandler::OnWillRead(scoped_refptr<net::IOBuffer>* buf,
                                          int* buf_size,
                                          int min_size) {
+  DCHECK(is_authorized_);
   DCHECK(buf && buf_size);
   if (!read_buffer_.get()) {
     *buf_size = min_size < 0 ? kReadBufSize : min_size;
@@ -73,6 +82,7 @@ bool SaveFileResourceHandler::OnWillRead(scoped_refptr<net::IOBuffer>* buf,
 }
 
 bool SaveFileResourceHandler::OnReadCompleted(int bytes_read, bool* defer) {
+  DCHECK(is_authorized_);
   DCHECK(read_buffer_.get());
   // We are passing ownership of this buffer to the save file manager.
   scoped_refptr<net::IOBuffer> buffer;
@@ -88,6 +98,9 @@ void SaveFileResourceHandler::OnResponseCompleted(
     const net::URLRequestStatus& status,
     const std::string& security_info,
     bool* defer) {
+  if (!is_authorized_)
+    DCHECK(!status.is_success());
+
   BrowserThread::PostTask(
       BrowserThread::FILE, FROM_HERE,
       base::Bind(&SaveFileManager::SaveFinished, save_manager_, save_item_id_,