Sanitize referrer in context menus.

chrome/browser/renderer_context_menu/render_view_context_menu.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_context_menu/render_view_context_menu.h"
 
 #include <algorithm>
 #include <set>
 #include <utility>
 
@@ skipping 1516 matching lines @@
           NEW_WINDOW, content::PAGE_TRANSITION_LINK);
       break;
 
     case IDC_CONTENT_CONTEXT_OPENLINKOFFTHERECORD:
       OpenURL(params_.link_url, GURL(), OFF_THE_RECORD,
               content::PAGE_TRANSITION_LINK);
       break;
 
     case IDC_CONTENT_CONTEXT_SAVELINKAS: {
       RecordDownloadSource(DOWNLOAD_INITIATED_BY_CONTEXT_MENU);
-      const GURL& referrer =
+      const GURL& url = params_.link_url;
+      const GURL& referring_url =
           params_.frame_url.is_empty() ? params_.page_url : params_.frame_url;
-      const GURL& url = params_.link_url;
+      content::Referrer referrer = content::Referrer::SanitizeForRequest(
+          url,
+          content::Referrer(referring_url.GetAsReferrer(),
+                            params_.referrer_policy));
       DownloadManager* dlm =
           BrowserContext::GetDownloadManager(browser_context_);
       scoped_ptr<DownloadUrlParameters> dl_params(
           DownloadUrlParameters::FromWebContents(source_web_contents_, url));
-      dl_params->set_referrer(
-          content::Referrer(referrer, params_.referrer_policy));
+      dl_params->set_referrer(referrer);
       dl_params->set_referrer_encoding(params_.frame_charset);
       dl_params->set_suggested_name(params_.suggested_filename);
       dl_params->set_prompt(true);
       dlm->DownloadUrl(dl_params.Pass());
       break;
     }
 
     case IDC_CONTENT_CONTEXT_SAVEAVAS:
     case IDC_CONTENT_CONTEXT_SAVEIMAGEAS: {
       if (params_.media_type == WebContextMenuData::MediaTypeCanvas) {
         source_web_contents_->GetRenderViewHost()->SaveImageAt(
           params_.x, params_.y);
       } else {
         // TODO(zino): We can use SaveImageAt() like a case of canvas.
         RecordDownloadSource(DOWNLOAD_INITIATED_BY_CONTEXT_MENU);
-        const GURL& referrer =
+        const GURL& url = params_.src_url;
+        const GURL& referring_url =
             params_.frame_url.is_empty() ? params_.page_url : params_.frame_url;
-        const GURL& url = params_.src_url;
-        source_web_contents_->SaveFrame(url, content::Referrer(
-            referrer, params_.referrer_policy));
+        content::Referrer referrer = content::Referrer::SanitizeForRequest(
+            url,
+            content::Referrer(referring_url.GetAsReferrer(),
+                              params_.referrer_policy));
+        source_web_contents_->SaveFrame(url, referrer);
       }
       break;
     }
 
     case IDC_CONTENT_CONTEXT_COPYLINKLOCATION:
       WriteURLToClipboard(params_.unfiltered_link_url);
       break;
 
     case IDC_CONTENT_CONTEXT_COPYIMAGELOCATION:
     case IDC_CONTENT_CONTEXT_COPYAVLOCATION:
@@ skipping 391 matching lines @@
                              kMaxSelectionTextLength,
                              gfx::WORD_BREAK);
 }
 
 // Controller functions --------------------------------------------------------
 
 void RenderViewContextMenu::OpenURL(
     const GURL& url, const GURL& referring_url,
     WindowOpenDisposition disposition,
     content::PageTransition transition) {
-  content::Referrer referrer(referring_url.GetAsReferrer(),
-      params_.referrer_policy);
+  content::Referrer referrer = content::Referrer::SanitizeForRequest(
+      url,
+      content::Referrer(referring_url.GetAsReferrer(),
+                        params_.referrer_policy));
 
   if (params_.link_url == url && disposition != OFF_THE_RECORD)
     params_.custom_context.link_followed = url;
 
   WebContents* new_contents = source_web_contents_->OpenURL(OpenURLParams(
       url, referrer, disposition, transition, false));
   if (!new_contents)
     return;
 
   RetargetingDetails details;
@@ skipping 46 matching lines @@
   source_web_contents_->GetRenderViewHost()->
       ExecuteMediaPlayerActionAtLocation(location, action);
 }
 
 void RenderViewContextMenu::PluginActionAt(
     const gfx::Point& location,
     const WebPluginAction& action) {
   source_web_contents_->GetRenderViewHost()->
       ExecutePluginActionAtLocation(location, action);
 }