Sanitize referrers for programmatic downloads.

content/browser/loader/resource_dispatcher_host_impl.cc

Index: content/browser/loader/resource_dispatcher_host_impl.cc
diff --git a/content/browser/loader/resource_dispatcher_host_impl.cc b/content/browser/loader/resource_dispatcher_host_impl.cc
index c5e067d8cd77d2a30bf0a0d702cef1bd32cb1514..44fbb93f2e41c0048a2361d61088079950a0d2fc 100644
--- a/content/browser/loader/resource_dispatcher_host_impl.cc
+++ b/content/browser/loader/resource_dispatcher_host_impl.cc
@@ -493,7 +493,11 @@ DownloadInterruptReason ResourceDispatcherHostImpl::BeginDownload(
   base::debug::Alias(url_buf);
   CHECK(ContainsKey(active_resource_contexts_, context));
 
-  SetReferrerForRequest(request.get(), referrer);
+  // Callers which create programmatic downloads do not necessarily sanitize
+  // the referrer, so do it here in a centralized location.
+  Referrer sanitized_referrer = SanitizeReferrerForRequest(request->url(),
+                                                           referrer);
+  SetReferrerForRequest(request.get(), sanitized_referrer);
 
   int extra_load_flags = net::LOAD_IS_DOWNLOAD;
   if (prefer_cache) {
@@ -1398,7 +1402,6 @@ void ResourceDispatcherHostImpl::BeginSaveFile(
       request_context->CreateRequest(url, net::DEFAULT_PRIORITY, NULL,
                                      cookie_store));
 
-  request->set_method("GET");
   SetReferrerForRequest(request.get(), referrer);
 
   // So far, for saving page, we need fetch content from cache, in the
@@ -2040,4 +2043,31 @@ int ResourceDispatcherHostImpl::BuildLoadFlagsForRequest(
   return load_flags;
 }
 
+Referrer SanitizeReferrerForRequest(const GURL& request,

[jochen (gone - plz use gerrit), 2014/05/14 08:32:19]

maybe that should be on content::Referrer (a static method, so it stays a
struct)?

+                                    const Referrer& referrer) {
+  Referrer sanitized_referrer;
+  sanitized_referrer.url = referrer.url.GetAsReferrer();
+  sanitized_referrer.policy = referrer.policy;
+  switch (sanitized_referrer.policy) {
+    case blink::WebReferrerPolicyDefault:
+      if (sanitized_referrer.url.SchemeIsSecure() &&
+          !request.SchemeIsSecure()) {
+        sanitized_referrer.url = GURL();
+      }
+      break;
+    case blink::WebReferrerPolicyAlways:
+      break;
+    case blink::WebReferrerPolicyNever:
+      sanitized_referrer.url = GURL();
+      break;
+    case blink::WebReferrerPolicyOrigin:
+      sanitized_referrer.url = sanitized_referrer.url.GetOrigin();
+      break;
+    default:
+      NOTREACHED();
+      break;
+  }
+  return sanitized_referrer;
+}
+
 }  // namespace content