Fix download attr on anchor allows download without user interaction

third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 408 matching lines @@
     ResourceRequest request(completedURL);
     request.setUIStartTime(event->platformTimeStamp());
     request.setInputPerfMetricReportPolicy(InputToLoadPerfMetricReportPolicy::ReportLink);
 
     ReferrerPolicy policy;
     if (hasAttribute(referrerpolicyAttr) && SecurityPolicy::referrerPolicyFromStringWithLegacyKeywords(fastGetAttribute(referrerpolicyAttr), &policy) && !hasRel(RelationNoReferrer)) {
         request.setHTTPReferrer(SecurityPolicy::generateReferrer(policy, completedURL, document().outgoingReferrer()));
     }
 
     if (hasAttribute(downloadAttr)) {
-        request.setRequestContext(WebURLRequest::RequestContextDownload);
-        bool isSameOrigin = completedURL.protocolIsData() || document().getSecurityOrigin()->canRequest(completedURL);
-        const AtomicString& suggestedName = (isSameOrigin ? fastGetAttribute(downloadAttr) : nullAtom);
+        if (event->isTrusted()) {
+            request.setRequestContext(WebURLRequest::RequestContextDownload);
+            bool isSameOrigin = completedURL.protocolIsData() || document().getSecurityOrigin()->canRequest(completedURL);
+            const AtomicString& suggestedName = (isSameOrigin ? fastGetAttribute(downloadAttr) : nullAtom);
 
-        frame->loader().client()->loadURLExternally(request, NavigationPolicyDownload, suggestedName, false);
+            frame->loader().client()->loadURLExternally(request, NavigationPolicyDownload, suggestedName, false);
+        } else {
+            // TODO: Throw an "InvalidAccessError" DOMException.

[Rick Byers, 2016/09/28 22:31:56]

I'm OK leaving this as follow-up work (it's probably non-trivial, have to plumb
an ExceptionState through), but the comment should reference an outstanding bug.
 Feel free to just refer to the existing bug and we can leave it open to track
fixing this completely.

+        }
     } else {
         request.setRequestContext(WebURLRequest::RequestContextHyperlink);
         FrameLoadRequest frameRequest(&document(), request, getAttribute(targetAttr));
         frameRequest.setTriggeringEvent(event);
         if (hasRel(RelationNoReferrer)) {
             frameRequest.setShouldSendReferrer(NeverSendReferrer);
             frameRequest.setShouldSetOpener(NeverSetOpener);
         }
         if (hasRel(RelationNoOpener))
             frameRequest.setShouldSetOpener(NeverSetOpener);
@@ skipping 32 matching lines @@
 }
 
 HTMLAnchorElement::NavigationHintSender* HTMLAnchorElement::ensureNavigationHintSender()
 {
     if (!m_navigationHintSender)
         m_navigationHintSender = NavigationHintSender::create(this);
     return m_navigationHintSender;
 }
 
 } // namespace blink