chromeos: Check both original and absolute paths for file: scheme

chrome/browser/net/chrome_network_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/net/chrome_network_delegate.h"
 
 #include <stddef.h>
 #include <stdlib.h>
 
 #include <vector>
@@ skipping 430 matching lines @@
         BrowserThread::UI, FROM_HERE,
         base::Bind(&TabSpecificContentSettings::CookieChanged,
                    info->GetWebContentsGetterForRequest(),
                    request.url(), request.first_party_for_cookies(),
                    cookie_line, *options, !allow));
   }
 
   return allow;
 }
 
-bool ChromeNetworkDelegate::OnCanAccessFile(const net::URLRequest& request,
-                                            const base::FilePath& path) const {
+bool ChromeNetworkDelegate::OnCanAccessFile(
+    const net::URLRequest& request,
+    const base::FilePath& original_path,
+    const base::FilePath& absolute_path) const {
 #if defined(OS_CHROMEOS)
   // If we're running Chrome for ChromeOS on Linux, we want to allow file
   // access. This is checked here to make IsAccessAllowed() unit-testable.
   if (!base::SysInfo::IsRunningOnChromeOS() ||
       base::CommandLine::ForCurrentProcess()->HasSwitch(switches::kTestType)) {
     return true;
   }
 #endif
 
+#if defined(OS_CHROMEOS)
+  // Use the absolute path on Chrome OS so that symbolic links that point to
+  // paths outside of the whitelist are rejected.
+  const base::FilePath& path = absolute_path;
+#else
+  // Use the original path on Android. Android's whitelist relies on symbolic
+  // links (ex. /sdcard is whitelisted and commonly a symbolic link).
+  const base::FilePath& path = original_path;
+#endif
   return IsAccessAllowed(path, profile_path_);
 }
 
 // static
 bool ChromeNetworkDelegate::IsAccessAllowed(
     const base::FilePath& path,
     const base::FilePath& profile_path) {
 #if !defined(OS_CHROMEOS) && !defined(OS_ANDROID)
   return true;
 #else
-
 #if defined(OS_CHROMEOS)
   // Use a whitelist to only allow access to files residing in the list of
   // directories below.
   static const char* const kLocalAccessWhiteList[] = {
       "/home/chronos/user/Downloads",
       "/home/chronos/user/log",
       "/home/chronos/user/WebRTC Logs",
       "/media",
       "/opt/oem",
       "/usr/share/chromeos-assets",
@@ skipping 72 matching lines @@
   if (!data_use_aggregator_)
     return;
 
   if (is_data_usage_off_the_record_) {
     data_use_aggregator_->ReportOffTheRecordDataUse(tx_bytes, rx_bytes);
     return;
   }
 
   data_use_aggregator_->ReportDataUse(request, tx_bytes, rx_bytes);
 }