Sanitize referrers before we create them

components/pdf/renderer/pepper_pdf_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/pdf/renderer/pepper_pdf_host.h"
 
 #include "components/pdf/common/pdf_messages.h"
 #include "components/pdf/renderer/pdf_resource_util.h"
 #include "components/pdf/renderer/ppb_pdf_impl.h"
 #include "content/public/common/referrer.h"
@@ skipping 135 matching lines @@
 int32_t PepperPDFHost::OnHostMsgSaveAs(
     ppapi::host::HostMessageContext* context) {
   content::PepperPluginInstance* instance =
       host_->GetPluginInstance(pp_instance());
   if (!instance)
     return PP_ERROR_FAILED;
   GURL url = instance->GetPluginURL();
   content::RenderView* render_view = instance->GetRenderView();
   blink::WebLocalFrame* frame =
       render_view->GetWebView()->mainFrame()->toWebLocalFrame();
-  content::Referrer referrer(frame->document().url(),
-                             frame->document().referrerPolicy());
+  content::Referrer referrer = content::Referrer::SanitizeForRequest(
+      url, content::Referrer(frame->document().url(),
+                             frame->document().referrerPolicy()));
   render_view->Send(
       new PDFHostMsg_PDFSaveURLAs(render_view->GetRoutingID(), url, referrer));
   return PP_OK;
 }
 
 int32_t PepperPDFHost::OnHostMsgGetResourceImage(
     ppapi::host::HostMessageContext* context,
     PP_ResourceImage image_id,
     float scale) {
   gfx::ImageSkia* res_image_skia = GetImageResource(image_id);
@@ skipping 114 matching lines @@
   pixels_to_write.copyPixelsTo(
       bitmap->getPixels(), bitmap->getSize(), bitmap->rowBytes());
 
   if (needs_unmapping)
     image_data->Unmap();
 
   return true;
 }
 
 }  // namespace pdf