Only take basename of default_file_name when starting a File Chooser.

chrome/browser/file_select_helper.cc

Index: chrome/browser/file_select_helper.cc
diff --git a/chrome/browser/file_select_helper.cc b/chrome/browser/file_select_helper.cc
index 965acfa5b9aef7700749b22e342eaa603122640d..71132a55a2cd922716a441fb15834d585fbd797b 100644
--- a/chrome/browser/file_select_helper.cc
+++ b/chrome/browser/file_select_helper.cc
@@ -459,9 +459,9 @@ void FileSelectHelper::RunFileChooserOnUIThread(
       NOTREACHED();
   }
 
-  base::FilePath default_file_name = params.default_file_name.IsAbsolute() ?
-      params.default_file_name :
-      profile_->last_selected_directory().Append(params.default_file_name);
+  // default_file_name is untrusted from renderer so only take basename.

[Lei Zhang, 2014/12/20 01:08:58]

nit: |default_file_name|

+  base::FilePath default_file_name = profile_->last_selected_directory().Append(
+      params.default_file_name.BaseName());
 
   gfx::NativeWindow owning_window =
       platform_util::GetTopLevel(render_view_host_->GetView()->GetNativeView());