Exclude files from FileSelectChooser if they can't convert to WebStrings.

content/browser/frame_host/render_frame_host_manager_browsertest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <memory>
 #include <set>
 
@@ skipping 1921 matching lines @@
   // the SwapOut ACK or a timeout.
   ASSERT_TRUE(rfh->IsRenderFrameLive());
   ASSERT_FALSE(rfh->is_active());
 
   // We specifically want verify behavior between swap-out and RFH destruction.
   ASSERT_FALSE(rfh_observer.deleted());
 
   EXPECT_FALSE(handler->IsJavascriptAllowed());
 }
 
+// Test for http://crbug.com/703303.  Ensures that the renderer process does not
+// try to select files whose paths cannot be converted to WebStrings.  This
+// check is done in the renderer because it is hard to predict which paths will
+// turn into empty WebStrings, and the behavior varies by platform.
+IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest, DontSelectInvalidFiles) {
+  StartServer();
+
+  // Use a file path with an invalid encoding, such that it can't be converted
+  // to a WebString (on all platforms but Windows).

[asanka, 2017/04/20 03:05:11]

Interesting. WebString allows invalid UTF-16?

It's possible to create a file on NTFS that's invalid UTF-16.

[Charlie Reis, 2017/04/20 19:00:38]

I was pretty surprised myself that WebString sent the string back up intact, but
yes, everything seems to work there without a kill.

I don't have an actual file on Windows to test with-- do you know how to create
such a file?  (I think it's probably fine to proceed with this either way, but
I'm curious to try it.)

[asanka, 2017/04/20 20:24:06]

------snip-----
#include<windows.h>

int main() {
  wchar_t filename[] = {
    'h', 'e', 'l', 'l', 'o', 0xd810, 0xd810, 0
  };
  HANDLE file = CreateFileW(filename, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS,
FILE_ATTRIBUTE_NORMAL, NULL);
  if (file == INVALID_HANDLE_VALUE)
    return 1;
  CloseHandle(file);
  return 0;
}
------------------

Build and run it on Windows. That should create a file with an invalid filename.

+  base::FilePath file;
+  EXPECT_TRUE(PathService::Get(base::DIR_TEMP, &file));
+  file = file.Append(FILE_PATH_LITERAL("foo\337bar"));
+
+  // Navigate and try to get page to reference this file in its PageState.
+  GURL url1(embedded_test_server()->GetURL("/file_input.html"));
+  NavigateToURL(shell(), url1);
+  int process_id = shell()->web_contents()->GetRenderProcessHost()->GetID();
+  std::unique_ptr<FileChooserDelegate> delegate(new FileChooserDelegate(file));
+  shell()->web_contents()->SetDelegate(delegate.get());
+  EXPECT_TRUE(
+      ExecuteScript(shell(), "document.getElementById('fileinput').click();"));
+  EXPECT_TRUE(delegate->file_chosen());
+
+  // The browser process grants access to the file whether or not the renderer
+  // process realizes that it can't use it.  This is ok, since the user actually
+  // did select the file from the chooser.
+  EXPECT_TRUE(ChildProcessSecurityPolicyImpl::GetInstance()->CanReadFile(
+      process_id, file));
+
+  // Disable the swap out timer so we wait for the UpdateState message.
+  static_cast<WebContentsImpl*>(shell()->web_contents())
+      ->GetMainFrame()
+      ->DisableSwapOutTimerForTesting();
+
+  // Navigate to a different process and wait for the old process to exit.
+  RenderProcessHostWatcher exit_observer(
+      shell()->web_contents()->GetRenderProcessHost(),
+      RenderProcessHostWatcher::WATCH_FOR_HOST_DESTRUCTION);
+  NavigateToURL(shell(), GetCrossSiteURL("/title1.html"));
+  exit_observer.Wait();
+  EXPECT_FALSE(ChildProcessSecurityPolicyImpl::GetInstance()->CanReadFile(
+      shell()->web_contents()->GetRenderProcessHost()->GetID(), file));
+
+  // The renderer process should not have been killed.  This is the important
+  // part of the test.  If this fails, then we didn't get a PageState to check
+  // below, so use an assert (since the test can't meaningfully proceed).
+  ASSERT_TRUE(exit_observer.did_exit_normally());
+
+  // Ensure that the file did not end up in the PageState of the previous entry,
+  // except on Windows where the path is valid and WebString can handle it.
+  NavigationEntry* prev_entry =
+      shell()->web_contents()->GetController().GetEntryAtIndex(0);
+  EXPECT_EQ(url1, prev_entry->GetURL());
+  const std::vector<base::FilePath>& files =
+      prev_entry->GetPageState().GetReferencedFiles();
+#if defined(OS_WIN)
+  EXPECT_EQ(1U, files.size());
+#else
+  EXPECT_EQ(0U, files.size());
+#endif
+}
+
 // Test for http://crbug.com/262948.
 IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
                        RestoreFileAccessForHistoryNavigation) {
   StartServer();
   base::FilePath file;
   EXPECT_TRUE(PathService::Get(base::DIR_TEMP, &file));
   file = file.AppendASCII("bar");
 
   // Navigate to url and get it to reference a file in its PageState.
   GURL url1(embedded_test_server()->GetURL("/file_input.html"));
@@ skipping 1322 matching lines @@
   // than one ancestor has the same URL (excluding fragments), and the
   // navigating frame's current URL shouldn't count toward that.
   EXPECT_TRUE(
       ExecuteScript(child, "location.href = '" + first_url.spec() + "';"));
   observer2.Wait();
 
   EXPECT_EQ(child->current_url(), first_url);
 }
 
 }  // namespace content