Merge 259353 "Mark drags starting in web content as tainted to a..."

Merge 259353 "Mark drags starting in web content as tainted to a..."

> Mark drags starting in web content as tainted to avoid file path forgery
> 
> This patch takes the simplest possible approach and simply clears any
> filename data when the browser-side dragenter handler notices that a
> drag originated from a Chrome renderer. This breaks file:// URL dragging
> within Chrome, but it turns out this is already mostly broken anyway.
> Dragging file:// URLs is filtered out by FilterURL, since we don't
> GrantRequestSpecificFileURL to the renderer, so it generally ends up
> loading about:blank anyway.
> 
> The ChromeOS bits are left unimplemented for the moment. The specific
> security issues fixed by this patch don't presently affect Aura because
> it doesn't implement the DownloadURL protocol at all, and it doesn't
> get confused between URLs and filenames like Linux. While it would be
> nice to implement this for ChromeOS, doing so breaks drags from the
> File Manager app.
> 
> BUG=346135
> R=creis@chromium.org, erg@chromium.org, sky@chromium.org, tony@chromium.org, tsepez@chromium.org
> 
> Review URL: https://codereview.chromium.org/207013003

TBR=dcheng@chromium.org

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=260001

[dcheng, 2014-03-27 21:51:16]

Committed patchset #1 manually as r260001.