Verify all files in the request body are accessible by the renderer process.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index f0397dfb883eb9b0dfa289fc3e2c5e4daa8c4269..2225c5c9535712a6fa85a5780a0a8305ee5c7146 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -2181,6 +2181,12 @@ void RenderFrameHostImpl::OnBeginNavigation(
   BeginNavigationParams validated_begin_params = begin_params;
   GetProcess()->FilterURL(true, &validated_begin_params.searchable_form_url);
 
+  if (!ValidateUploadParams(validated_params)) {
+    bad_message::ReceivedBadMessage(GetProcess(),
+                                    bad_message::RFH_ILLEGAL_UPLOAD_PARAMS);
+    return;
+  }
+
   if (waiting_for_init_) {
     pendinging_navigate_ = base::MakeUnique<PendingNavigation>(
         validated_params, validated_begin_params);
@@ -3963,6 +3969,36 @@ void RenderFrameHostImpl::SetLastCommittedSiteUrl(const GURL& url) {
   }
 }
 
+bool RenderFrameHostImpl::ValidateUploadParams(
+    const CommonNavigationParams& common_params) {
+  if (!common_params.post_data.get())
+    return true;
+
+  // Check if the renderer is permitted to upload the requested files.
+  const std::vector<ResourceRequestBodyImpl::Element>* uploads =
+      common_params.post_data->elements();
+  std::vector<ResourceRequestBodyImpl::Element>::const_iterator iter;
+  ChildProcessSecurityPolicyImpl* security_policy =
+      ChildProcessSecurityPolicyImpl::GetInstance();
+  for (iter = uploads->begin(); iter != uploads->end(); ++iter) {
+    if (iter->type() == ResourceRequestBodyImpl::Element::TYPE_FILE &&
+        !security_policy->CanReadFile(GetProcess()->GetID(), iter->path())) {
+      return false;
+    }
+    if (iter->type() ==
+        ResourceRequestBodyImpl::Element::TYPE_FILE_FILESYSTEM) {
+      StoragePartition* storage_partition = BrowserContext::GetStoragePartition(
+          GetSiteInstance()->GetBrowserContext(), GetSiteInstance());
+      storage::FileSystemURL url =
+          storage_partition->GetFileSystemContext()->CrackURL(
+              iter->filesystem_url());
+      if (!security_policy->CanReadFileSystemFile(GetProcess()->GetID(), url))
+        return false;
+    }
+  }
+  return true;
+}
+
 #if defined(OS_ANDROID)
 
 class RenderFrameHostImpl::JavaInterfaceProvider