Lock down creation of "filesystem:chrome-extension://" URLs

content/browser/child_process_security_policy_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/child_process_security_policy_impl.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 778 matching lines @@
   return result;
 }
 
 bool ChildProcessSecurityPolicyImpl::HasPermissionsForFileSystemFile(
     int child_id,
     const storage::FileSystemURL& url,
     int permissions) {
   if (!url.is_valid())
     return false;
 
+  // If |url.origin()| is not committable in this process, then this page
+  // should not be able to place content in that origin via the filesystem
+  // API either.
+  if (!CanCommitURL(child_id, url.origin()))
+    return false;

[Charlie Reis, 2016/10/04 22:19:04]

Consider adding a UMA to detect if this is happening too often?

[ncarter (slow), 2016/10/04 23:09:36]

Done.

+
   if (url.path().ReferencesParent())
     return false;
 
   // Any write access is disallowed on the root path.
   if (storage::VirtualPath::IsRootPath(url.path()) &&
       (permissions & ~READ_FILE_GRANT)) {
     return false;
   }
 
   if (url.mount_type() == storage::kFileSystemTypeIsolated) {
@@ skipping 154 matching lines @@
   base::AutoLock lock(lock_);
 
   SecurityStateMap::iterator state = security_state_.find(child_id);
   if (state == security_state_.end())
     return false;
 
   return state->second->can_send_midi_sysex();
 }
 
 }  // namespace content