[PPAPI] Quarantine files that are writeable by a Pepper plugin.

chrome/test/ppapi/ppapi_filechooser_browsertest.cc

Index: chrome/test/ppapi/ppapi_filechooser_browsertest.cc
diff --git a/chrome/test/ppapi/ppapi_filechooser_browsertest.cc b/chrome/test/ppapi/ppapi_filechooser_browsertest.cc
index 90816e996ad020f19ba9406d856d5c190fee6f25..8028f65bdcd99660673a56942b83164a85c20a2b 100644
--- a/chrome/test/ppapi/ppapi_filechooser_browsertest.cc
+++ b/chrome/test/ppapi/ppapi_filechooser_browsertest.cc
@@ -16,6 +16,10 @@
 #include "ui/shell_dialogs/select_file_dialog_factory.h"
 #include "ui/shell_dialogs/selected_file_info.h"
 
+#if defined(OS_WIN)
+#include "base/win/scoped_handle.h"
+#endif
+
 #if defined(FULL_SAFE_BROWSING)
 #include "chrome/browser/safe_browsing/download_protection_service.h"
 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
@@ -349,6 +353,33 @@ IN_PROC_BROWSER_TEST_F(PPAPIFileChooserTest, FileChooser_SaveAs_Cancel) {
   RunTestViaHTTP("FileChooser_SaveAsCancel");
 }
 
+#if defined(OS_WIN)

[bbudge, 2016/07/11 20:08:22]

Could you add a comment explaining what this tests, and how zone_identifier
works? I think it would be difficult for anyone who is not familiar with the
issue to figure out just from reading this code.

[asanka, 2016/09/12 16:07:04]

Done.

+IN_PROC_BROWSER_TEST_F(PPAPIFileChooserTest,
+                       FileChooser_WindowsMOTW_DependsOnLocalConfig) {
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+  base::FilePath suggested_filename = temp_dir.path().AppendASCII("foo");
+
+  TestSelectFileDialogFactory::SelectedFileInfoList file_info_list;
+  file_info_list.push_back(
+      ui::SelectedFileInfo(suggested_filename, suggested_filename));
+  TestSelectFileDialogFactory test_dialog_factory(
+      TestSelectFileDialogFactory::REPLACE_BASENAME, file_info_list);
+
+  RunTestViaHTTP("FileChooser_SaveAsDangerousExecutableAllowed");
+  base::FilePath actual_filename = temp_dir.path().AppendASCII("dangerous.exe");
+
+  ASSERT_TRUE(base::PathExists(actual_filename));
+  const DWORD kShare = FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE;
+  base::FilePath::StringType zone_identifier_path =
+      actual_filename.value() + L":Zone.Identifier";
+  base::win::ScopedHandle zone_identifier(
+      CreateFile(zone_identifier_path.c_str(), GENERIC_READ, kShare, nullptr,
+                 OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr));
+  EXPECT_TRUE(zone_identifier.IsValid());
+}
+#endif
+
 #if defined(FULL_SAFE_BROWSING)
 // These tests only make sense when SafeBrowsing is enabled. They verify
 // that files written via the FileChooser_Trusted API are properly passed