Commit message: None
CVE: CVE-2013-0889
CWE: CWE-264
Vulnerability description: Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly enforce a user gesture requirement before proceeding with a file download, which might make it easier for remote attackers to execute arbitrary code via a crafted file.

Project: Chrome

void ChromeDownloadManagerDelegate::CheckDownloadUrlDone(
    int32 download_id,
    const content::DownloadTargetCallback& callback,
    DownloadProtectionService::DownloadCheckResult result) {
  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
  DownloadItem* download = download_manager_->GetDownload(download_id);
  if (!download || (download->GetState() != DownloadItem::IN_PROGRESS))
    return;

  VLOG(2) << __FUNCTION__ << "() download = " << download->DebugString(false)
          << " verdict = " << result;
  content::DownloadDangerType danger_type = download->GetDangerType();
  if (result != DownloadProtectionService::SAFE)
    danger_type = content::DOWNLOAD_DANGER_TYPE_DANGEROUS_URL;

  HistoryService* history = HistoryServiceFactory::GetForProfile(
      profile_, Profile::EXPLICIT_ACCESS);
  if (!history || !download->GetReferrerUrl().is_valid()) {
    CheckVisitedReferrerBeforeDone(download_id, callback, danger_type, false);
    return;
  }
  history->GetVisibleVisitCountToHost(
      download->GetReferrerUrl(), &history_consumer_,
      base::Bind(&VisitCountsToVisitedBefore, base::Bind(
          &ChromeDownloadManagerDelegate::CheckVisitedReferrerBeforeDone,
          this, download_id, callback, danger_type)));
}

Project: Chrome

FilePath ChromeDownloadManagerDelegate::GetIntermediatePath(
    const FilePath& target_path,
    content::DownloadDangerType danger_type) {
  if (danger_type == content::DOWNLOAD_DANGER_TYPE_NOT_DANGEROUS)
    return download_util::GetCrDownloadPath(target_path);

  FilePath::StringType file_name;
  FilePath dir = target_path.DirName();
#if defined(OS_WIN)
  string16 unconfirmed_prefix =
      l10n_util::GetStringUTF16(IDS_DOWNLOAD_UNCONFIRMED_PREFIX);
#else
  std::string unconfirmed_prefix =
      l10n_util::GetStringUTF8(IDS_DOWNLOAD_UNCONFIRMED_PREFIX);
#endif
  base::SStringPrintf(
      &file_name,
      unconfirmed_prefix.append(
          FILE_PATH_LITERAL(" %d.crdownload")).c_str(),
      base::RandInt(0, 1000000));
  return dir.Append(file_name);
}

Project: Chrome

void ChromeDownloadManagerDelegate::Observe(
    int type,
    const content::NotificationSource& source,
    const content::NotificationDetails& details) {
  DCHECK(type == chrome::NOTIFICATION_CRX_INSTALLER_DONE);

  registrar_.Remove(this,
                    chrome::NOTIFICATION_CRX_INSTALLER_DONE,
                    source);

  scoped_refptr<extensions::CrxInstaller> installer =
      content::Source<extensions::CrxInstaller>(source).ptr();
  content::DownloadOpenDelayedCallback callback = crx_installers_[installer];
  crx_installers_.erase(installer.get());
  callback.Run(installer->did_handle_successfully());
}

Project: Chrome

void OnWebIntentDispatchCompleted(
    const FilePath& file_path,
    webkit_glue::WebIntentReplyType intent_reply) {
  BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
                          base::Bind(&DeleteFile, file_path));
}