Only take basename of default_file_name when starting a File Chooser.

chrome/browser/file_select_helper.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/file_select_helper.h"
 
 #include <string>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 441 matching lines @@
       break;
     case FileChooserParams::Save:
       dialog_type_ = ui::SelectFileDialog::SELECT_SAVEAS_FILE;
       break;
     default:
       // Prevent warning.
       dialog_type_ = ui::SelectFileDialog::SELECT_OPEN_FILE;
       NOTREACHED();
   }
 
-  base::FilePath default_file_name = params.default_file_name.IsAbsolute() ?
-      params.default_file_name :
-      profile_->last_selected_directory().Append(params.default_file_name);
+  // default_file_name is untrusted from renderer so only take basename.

[Lei Zhang, 2014/12/20 01:08:58]

nit: |default_file_name|

+  base::FilePath default_file_name = profile_->last_selected_directory().Append(
+      params.default_file_name.BaseName());
 
   gfx::NativeWindow owning_window =
       platform_util::GetTopLevel(render_view_host_->GetView()->GetNativeView());
 
 #if defined(OS_ANDROID)
   // Android needs the original MIME types and an additional capture value.
   std::pair<std::vector<base::string16>, bool> accept_types =
       std::make_pair(params.accept_types, params.capture);
 #endif
 
@@ skipping 91 matching lines @@
   // of an extension or a "/" in the case of a MIME type).
   std::string unused;
   if (accept_type.length() <= 1 ||
       base::StringToLowerASCII(accept_type) != accept_type ||
       base::TrimWhitespaceASCII(accept_type, base::TRIM_ALL, &unused) !=
           base::TRIM_NONE) {
     return false;
   }
   return true;
 }