Remove special DataTransfer permissions for file: origins.

third_party/WebKit/LayoutTests/fast/dnd/resources/copy-data-transfer.js

Index: third_party/WebKit/LayoutTests/fast/dnd/resources/copy-data-transfer.js
diff --git a/third_party/WebKit/LayoutTests/fast/dnd/resources/copy-data-transfer.js b/third_party/WebKit/LayoutTests/fast/dnd/resources/copy-data-transfer.js
new file mode 100644
index 0000000000000000000000000000000000000000..5a94b8a3cd98f465465f2dc6f489e92fad68d511
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/dnd/resources/copy-data-transfer.js
@@ -0,0 +1,75 @@
+// Copies the information out of a DataTransfer instance. This is necessary
+// because dataTransfer instances get neutered after their event handlers exit.
+//
+// Returns a Promise that resolves to an object which mirrors the DataTransfer's
+// files, items, and types attributes, as well as the return values of the
+// getData function.

[jsbell, 2016/12/16 21:16:16]

... and the contents of files via FileReaders.

[pwnall, 2016/12/17 00:44:48]

Done.

+const copyDataTransfer = (dataTransfer) => {
+  const types = dataTransfer.types.slice();
+  const data = {};
+  for (let type of types) {
+    try {
+      data[type] = dataTransfer.getData(type);
+    } catch(e) {  // Catches SecurityError exceptions.
+      data[type] = e;
+    }
+  }
+
+  const readerPromises = [];
+
+  // DataTransfer.files returns a FileList. According to the spec, FileList only

[jsbell, 2016/12/16 21:16:16]

Consider using Array.from(dataTransfer.files || []) if you want something you
can iterate/map over more easily.

[pwnall, 2016/12/17 00:44:48]

Would this work cross-browser?

Array.from() wants an array-like object (.length and []) or an iterable. The
drag-and-drop spec states that DataTransfer.files returns a FileList. This is
spec'd in the File API TR as an object with .length and .item(index). Notably,
the [] operator is missing.

[jsbell, 2016/12/19 17:25:17]

The spec has:

 getter File? item(unsigned long index);
 
Which per WebIDL (https://heycam.github.io/webidl/#idl-special-operations) is
the same as having both:

 getter File? (unsigned long index);
 File? item(unsigned long index);

Where 'getter' defines the indexed property lookup behavior ('[] operator').

So this should be fine cross-browser.

[pwnall, 2016/12/19 21:51:19]

Done.
Thank you for explaining! I'll schedule a WebIDL spec reading in the nearby
future.

+  // supports .length and .item().
+  const files = [];
+  const fileList = dataTransfer.files || [];
+  for (let i = 0; i < fileList.length; ++i) {
+    const file = fileList.item(i);
+    const fileData = { file: file };
+    files.push(fileData);
+
+    readerPromises.push(new Promise((resolve, reject) => {
+      const reader = new FileReader();
+      reader.onloadend = (event) => {
+        if (event.target.error)
+          fileData.data = event.target.error;

[jsbell, 2016/12/16 21:16:16]

assigning to .data rather than .error here - intentional?

[pwnall, 2016/12/17 00:44:48]

Done.

Thanks for catching this!
It helped while developing, but I think .error makes more sense given the
current asserts.

+        else
+          fileData.data = event.target.result;
+        resolve();
+      };
+      reader.readAsText(file);
+    }).catch(e => fileData.error = e));
+  }
+
+  // DataTransfer.items returns an DataTransferItemList, which supports .length

[jsbell, 2016/12/16 21:16:16]

Same as above, re: Array.from()

[pwnall, 2016/12/17 00:44:48]

Done.

+  // and indexed access.
+  const items = [];
+  const itemList = dataTransfer.items || [];
+  for (let i = 0; i < dataTransfer.items.length; ++i) {
+    const item = dataTransfer.items[i];
+    const itemData = { kind: item.kind, type: item.type };
+    items.push(itemData);
+
+    readerPromises.push(new Promise((resolve, reject) => {
+      if (itemData.kind === 'file') {
+        itemData.file = item.getAsFile();
+        if (itemData.file === null) {  // DataTransfer is in protected mode.
+          resolve();
+          return;
+        }
+
+        const reader = new FileReader();
+        reader.onloadend = (event) => {
+          if (event.target.error)
+            itemData.data = event.target.error;
+          else
+            itemData.data = event.target.result;
+          resolve();
+        };
+        reader.readAsText(itemData.file);
+      }
+    }).catch(e => itemData.error = e));
+  }
+
+  return Promise.all(readerPromises).then(() => {
+    return { data: data, files: files, items: items, types: types };

[jsbell, 2016/12/16 21:16:16]

Style guide issue: can we start using simplified initializer notation? 

return { data, files, items, types };

This is in ES2015, so just as old as arrow functions. Google's ES6 guide says
yes:
https://google.github.io/styleguide/jsguide.html#features-objects-shorthand-p...
but Chromium may vary.

[pwnall, 2016/12/17 00:44:48]

Done.

AFAIK , Chromium's style guide still uses the old ES5 Google style guide as a
baseline, because of build pipeline issues (e.g., Closure). My layout tests
writeup uses the new ES6 style guide as a baseline, because layout tests don't
use any build pipeline, so the issues aren't relevant. So, this should work.

Thanks for pointing out this ES6 feature! I'm still wrapping my head around it.

+  });
+};