[BlobStorage] Added back security policy for files in blobs

content/browser/blob_storage/blob_dispatcher_host.cc

Index: content/browser/blob_storage/blob_dispatcher_host.cc
diff --git a/content/browser/blob_storage/blob_dispatcher_host.cc b/content/browser/blob_storage/blob_dispatcher_host.cc
index 2c43055a5ecf3c7b9ff45cb2269bbfb5910aed77..ac8967f372a741d36d7deb5b0a65b8b555b5940a 100644
--- a/content/browser/blob_storage/blob_dispatcher_host.cc
+++ b/content/browser/blob_storage/blob_dispatcher_host.cc
@@ -10,6 +10,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/blob_storage/chrome_blob_storage_context.h"
+#include "content/browser/child_process_security_policy_impl.h"
 #include "content/common/fileapi/webblob_messages.h"
 #include "ipc/ipc_platform_file.h"
 #include "storage/browser/blob/blob_storage_context.h"
@@ -22,6 +23,7 @@
 using storage::BlobStorageContext;
 using storage::BlobStorageRegistry;
 using storage::BlobTransportResult;
+using storage::DataElement;
 using storage::IPCBlobCreationCancelCode;
 
 namespace content {
@@ -36,9 +38,11 @@ enum RefcountOperation {
 
 } // namespace
 
-BlobDispatcherHost::BlobDispatcherHost(
+BlobDispatcherHost::BlobDispatcherHost(int process_id,
     ChromeBlobStorageContext* blob_storage_context)
     : BrowserMessageFilter(BlobMsgStart),
+      process_id_(process_id),
+      security_policy_(ChildProcessSecurityPolicyImpl::GetInstance()),
       blob_storage_context_(blob_storage_context) {}
 
 BlobDispatcherHost::~BlobDispatcherHost() {
@@ -136,6 +140,18 @@ void BlobDispatcherHost::OnStartBuildingBlob(
     SendIPCResponse(uuid, BlobTransportResult::BAD_IPC);
     return;
   }
+
+  for (const DataElement& item : descriptions) {
+    if (item.type() == storage::DataElement::TYPE_FILE &&
+        !security_policy_->CanReadFile(process_id_, item.path())) {

[kinuko, 2016/08/05 00:39:36]

I think we used to have the same / similar check for TYPE_FILE_FILESYSTEM too?

[dmurph, 2016/08/05 01:15:51]

Oops! Yep, done, added.

+      async_builder_.CancelBuildingBlob(
+          uuid, IPCBlobCreationCancelCode::FILE_WRITE_FAILED, context);
+      Send(new BlobStorageMsg_CancelBuildingBlob(
+          uuid, IPCBlobCreationCancelCode::FILE_WRITE_FAILED));
+      return;
+    }
+  }
+
   // |this| owns async_builder_ so using base::Unretained(this) is safe.
   BlobTransportResult result = async_builder_.StartBuildingBlob(
       uuid, descriptions, context->memory_available(), context,