Index: content/browser/fileapi/fileapi_message_filter.cc |
diff --git a/content/browser/fileapi/fileapi_message_filter.cc b/content/browser/fileapi/fileapi_message_filter.cc |
index 99439b742ac06bb8d7cef00da0376a8fb317f6cb..379f509c650a7bb1128d9bfecbecad3761ab26e0 100644 |
--- a/content/browser/fileapi/fileapi_message_filter.cc |
+++ b/content/browser/fileapi/fileapi_message_filter.cc |
@@ -63,7 +63,7 @@ namespace { |
void RevokeFilePermission(int child_id, const base::FilePath& path) { |
ChildProcessSecurityPolicyImpl::GetInstance()->RevokeAllPermissionsForFile( |
- child_id, path); |
+ child_id, path); |
} |
} // namespace |
@@ -500,7 +500,7 @@ void FileAPIMessageFilter::OnCancel( |
void FileAPIMessageFilter::OnOpenPepperFile( |
int request_id, const GURL& path, int pp_open_flags) { |
DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO)); |
-FileSystemURL url(context_->CrackURL(path)); |
+ FileSystemURL url(context_->CrackURL(path)); |
if (!ValidateFileSystemURL(request_id, url)) |
return; |
if (!CanOpenFileSystemURLWithPepperFlags(pp_open_flags, process_id_, url)) { |
@@ -627,6 +627,13 @@ void FileAPIMessageFilter::OnAppendBlobDataItemToBlob( |
ignore_result(blob_storage_host_->CancelBuildingBlob(uuid)); |
return; |
} |
+#if defined(OS_ANDROID) |
+ if (item.type() == BlobData::Item::TYPE_CONTENT_URL && |
+ !security_policy_->CanReadContentUrl(process_id_, item.content_url())) { |
+ ignore_result(blob_storage_host_->CancelBuildingBlob(uuid)); |
+ return; |
+ } |
+#endif |
if (item.length() == 0) { |
BadMessageReceived(); |
return; |
@@ -692,7 +699,7 @@ void FileAPIMessageFilter::OnStartBuildingStream( |
DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO)); |
// Only an internal Blob URL is expected here. See the BlobURL of the Blink. |
if (!StartsWithASCII( |
- url.path(), "blobinternal%3A///", true /* case_sensitive */)) { |
+ url.path(), "blobinternal%3A///", true /* case_sensitive */)) { |
NOTREACHED() << "Malformed Stream URL: " << url.spec(); |
BadMessageReceived(); |
return; |
@@ -942,7 +949,7 @@ void FileAPIMessageFilter::DidCreateSnapshot( |
// Return the file info and platform_path. |
Send(new FileSystemMsg_DidCreateSnapshotFile( |
- request_id, info, platform_path)); |
+ request_id, info, platform_path)); |
} |
bool FileAPIMessageFilter::ValidateFileSystemURL( |