[Merge to M54] Disallow file api access from processes that lack permissions for the scheme of the …

content/browser/child_process_security_policy_impl.cc

Index: content/browser/child_process_security_policy_impl.cc
diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
index 44180df83455216528dd25608431aa262a5a139c..a43de17a2a12de8ddebbb41e41464a7e41d95b84 100644
--- a/content/browser/child_process_security_policy_impl.cc
+++ b/content/browser/child_process_security_policy_impl.cc
@@ -787,6 +787,14 @@ bool ChildProcessSecurityPolicyImpl::HasPermissionsForFileSystemFile(
   if (!url.is_valid())
     return false;
 
+  // If |url.origin()| is not committable in this process, then this page
+  // should not be able to place content in that origin via the filesystem
+  // API either.
+  if (!CanCommitURL(child_id, url.origin())) {
+    UMA_HISTOGRAM_BOOLEAN("FileSystem.OriginFailedCanCommitURL", true);
+    return false;
+  }
+
   if (url.path().ReferencesParent())
     return false;