Improved security of Quick View by rendering videos and audios inside webview.

ui/file_manager/file_manager/foreground/js/quick_view_controller.js

 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * Controller for QuickView.
  *
  * @param {!FilesQuickView} quickView
  * @param {!MetadataModel} metadataModel File system metadata.
  * @param {!FileSelectionHandler} selectionHandler
@@ skipping 215 matching lines @@
 QuickViewController.prototype.getQuickViewParameters_ = function(entry, items) {
   var item = items[0];
   var type = FileType.getType(entry).type;
 
   /** @type {!QuickViewParams} */
   var params = {
     type: type,
     filePath: entry.name,
   };
 
+  /**
+   * @type function(!FileEntry): !Promise<!File>
+   */
+  var getFile = function(entry) {
+    return new Promise(function(resolve, reject) {
+      entry.file(resolve, reject);
+    });
+  };
+
   if (type === 'image') {
     if (item.externalFileUrl) {
       if (item.thumbnailUrl) {
         return this.loadThumbnailFromDrive_(item.thumbnailUrl)
             .then(function(result) {
               if (result.status === 'success')
                 params.contentUrl = result.data;
               return params;
             }.bind(this));
       }
     } else {
-      return new Promise(function(resolve, reject) {
-        entry.file(function(file) {
-          params.contentUrl = URL.createObjectURL(file);
-          resolve(params);
-        });
+      return getFile(entry).then(function(file) {
+        params.contentUrl = URL.createObjectURL(file);
+        return params;
       });
     }
   } else if (type === 'video') {
     if (item.externalFileUrl) {
       if (item.thumbnailUrl) {
         return this.loadThumbnailFromDrive_(item.thumbnailUrl)
             .then(function(result) {
               if (result.status === 'success') {
                 params.videoPoster = result.data;
               }
               return params;
             });
       }
     } else {
-      params.contentUrl = entry.toURL();
       params.autoplay = true;
       if (item.thumbnailUrl) {
         params.videoPoster = item.thumbnailUrl;
       }
+      return getFile(entry).then(function(file) {
+        params.contentUrl = URL.createObjectURL(file);
+        return params;
+      });
     }
   } else if (type === 'audio') {
     if (item.externalFileUrl) {
       // If the file is in Drive, we ask user to open it with external app.
     } else {
-      params.contentUrl = entry.toURL();
       params.autoplay = true;
-      return this.metadataModel_.get([entry], ['contentThumbnailUrl'])
-          .then(function(entry, items) {
+      return Promise
+          .all([
+            this.metadataModel_.get([entry], ['contentThumbnailUrl']),
+            getFile(entry)
+          ])
+          .then(function(values) {
+            /** @type {!Array<!MetadataItem>} */
+            var items = values[0];
+            /** @type {!File} */
+            var file = values[1];
             var item = items[0];
             if (item.contentThumbnailUrl) {
               params.audioArtwork = item.contentThumbnailUrl;
             }
+            params.contentUrl = URL.createObjectURL(file);
             return params;
-          }.bind(this, entry));
+          });
     }
   }
   return Promise.resolve(params);
 };
 
 /**
  * Loads a thumbnail from Drive.
  *
  * @param {string} url Thumbnail url
  * @return Promise<{{status: string, data:string, width:number, height:number}}>
  * @private
  */
 QuickViewController.prototype.loadThumbnailFromDrive_ = function(url) {
   return new Promise(function(resolve) {
     ImageLoaderClient.getInstance().load(url, resolve)
   });
 };