Generated FIlename different from Content Disposition string

net/base/filename_util_internal.cc

Index: net/base/filename_util_internal.cc
diff --git a/net/base/filename_util_internal.cc b/net/base/filename_util_internal.cc
index 49b6a3db923d52fef031f1a666563422241dc793..8ebe442c0438b51819499c3ccfb0b1e1b1463f70 100644
--- a/net/base/filename_util_internal.cc
+++ b/net/base/filename_util_internal.cc
@@ -229,11 +229,13 @@ base::string16 GetSuggestedFilenameImpl(
       FILE_PATH_LITERAL("download");
   std::string filename;  // In UTF-8
   bool overwrite_extension = false;
-
+  bool is_name_from_content_disposition = false;
   // Try to extract a filename from content-disposition first.
   if (!content_disposition.empty()) {
     HttpContentDisposition header(content_disposition, referrer_charset);
     filename = header.filename();
+    if (!filename.empty())
+      is_name_from_content_disposition = true;
   }
 
   // Then try to use the suggested name.
@@ -275,7 +277,10 @@ base::string16 GetSuggestedFilenameImpl(
   }
   replace_illegal_characters_callback.Run(&result_str, '-');
   base::FilePath result(result_str);
-  GenerateSafeFileName(mime_type, overwrite_extension, &result);
+  // extension is not appended to filename derived from content-disposition,
+  // if it doesnot have one
+  if (!is_name_from_content_disposition)
+    GenerateSafeFileName(mime_type, overwrite_extension, &result);

[asanka, 2014/10/08 15:58:29]

This step isn't optional. The fact that a filename was specified in a
Content-Disposition header doesn't mean it should be used as is, and it could
potentially be attacker controlled.

Perhaps the correct fix is to honor the |overwrite_extension| flag even if the
extension is empty or avoid using an extension for a common blacklist of mime
types?

 
   base::string16 result16;
   if (!FilePathToString16(result, &result16)) {