Don't enforce X-Frame-Options for downloads.

content/browser/download/download_browsertest.cc

Index: content/browser/download/download_browsertest.cc
diff --git a/content/browser/download/download_browsertest.cc b/content/browser/download/download_browsertest.cc
index 67bc08dbdd14a1034c74ede02fb0e1898119fee2..a70c990fb966e84d1a377e5efcf56053e2f4c560 100644
--- a/content/browser/download/download_browsertest.cc
+++ b/content/browser/download/download_browsertest.cc
@@ -55,6 +55,7 @@
 #include "content/shell/browser/shell_browser_context.h"
 #include "content/shell/browser/shell_download_manager_delegate.h"
 #include "content/shell/browser/shell_network_delegate.h"
+#include "content/test/content_browser_test_utils_internal.h"
 #include "device/power_save_blocker/power_save_blocker.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
@@ -2715,4 +2716,31 @@ IN_PROC_BROWSER_TEST_F(ParallelDownloadTest, ParallelDownloadComplete) {
                             download->GetTargetFilePath());
 }
 
+// Test to verify that the browser-side enforcement of X-Frame-Options does
+// not impact downloads. Since XFO is only checked for subframes, this test
+// initiates a download in an iframe and expects it to succeed.

[alexmos, 2017/05/10 23:41:20]

nit: might be nice to reference 717971 here, which has some comments by mkwst@
about why this should be done.

+IN_PROC_BROWSER_TEST_F(DownloadContentTest, DownloadIgnoresXFO) {
+  GURL main_url(
+      embedded_test_server()->GetURL("/cross_site_iframe_factory.html?a(b)"));
+  GURL download_url(
+      embedded_test_server()->GetURL("/download/download-with-xfo-deny.html"));
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+
+  std::unique_ptr<DownloadTestObserver> observer(CreateWaiter(shell(), 1));
+  NavigateFrameToURL(web_contents->GetFrameTree()->root()->child_at(0),
+                     download_url);
+  observer->WaitForFinished();
+  EXPECT_EQ(1u, observer->NumDownloadsSeenInState(DownloadItem::COMPLETE));
+
+  std::vector<DownloadItem*> downloads;
+  DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
+  ASSERT_EQ(1u, downloads.size());
+
+  EXPECT_EQ(FILE_PATH_LITERAL("foo"),
+            downloads[0]->GetTargetFilePath().BaseName().value());
+}
+
 }  // namespace content