chromeos: Check both original and absolute paths for file: scheme

net/url_request/url_request_file_job.cc

Index: net/url_request/url_request_file_job.cc
diff --git a/net/url_request/url_request_file_job.cc b/net/url_request/url_request_file_job.cc
index 4924e02349100a852f8c4499472ea42bef3feb6b..0b91377a8bfe70090734ce4ebb701e003486ca61 100644
--- a/net/url_request/url_request_file_job.cc
+++ b/net/url_request/url_request_file_job.cc
@@ -196,6 +196,12 @@ std::unique_ptr<SourceStream> URLRequestFileJob::SetUpSourceStream() {
   return GzipSourceStream::Create(std::move(source), SourceStream::TYPE_GZIP);
 }
 
+bool URLRequestFileJob::CanAccessFile(const base::FilePath& original_path,
+                                      const base::FilePath& absolute_path) {
+  return (!network_delegate() || network_delegate()->CanAccessFile(
+                                     *request(), original_path, absolute_path));
+}
+
 void URLRequestFileJob::FetchMetaInfo(const base::FilePath& file_path,
                                       FileMetaInfo* meta_info) {
   base::File::Info file_info;
@@ -208,6 +214,7 @@ void URLRequestFileJob::FetchMetaInfo(const base::FilePath& file_path,
   // done in WorkerPool.
   meta_info->mime_type_result = GetMimeTypeFromFile(file_path,
                                                     &meta_info->mime_type);
+  meta_info->absolute_path = base::MakeAbsoluteFilePath(file_path);
 }
 
 void URLRequestFileJob::DidFetchMetaInfo(const FileMetaInfo* meta_info) {
@@ -230,6 +237,11 @@ void URLRequestFileJob::DidFetchMetaInfo(const FileMetaInfo* meta_info) {
     return;
   }
 
+  if (CanAccessFile(file_path_, meta_info->absolute_path)) {
+    DidOpen(ERR_ACCESS_DENIED);
+    return;
+  }
+
   int flags = base::File::FLAG_OPEN |
               base::File::FLAG_READ |
               base::File::FLAG_ASYNC;