Restrict file access on android.

chrome/browser/net/chrome_network_delegate.cc

Index: chrome/browser/net/chrome_network_delegate.cc
diff --git a/chrome/browser/net/chrome_network_delegate.cc b/chrome/browser/net/chrome_network_delegate.cc
index 5bd65b1d1790ce2e72eda8facafd2e1cfee73bac..9404e25244a1d7044351b1ae4dcf91be8415849b 100644
--- a/chrome/browser/net/chrome_network_delegate.cc
+++ b/chrome/browser/net/chrome_network_delegate.cc
@@ -5,6 +5,8 @@
 #include "chrome/browser/net/chrome_network_delegate.h"
 
 #include "base/logging.h"
+#include "base/base_paths.h"
+#include "base/path_service.h"
 #include "chrome/browser/api/prefs/pref_member.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/content_settings/cookie_settings.h"
@@ -51,9 +53,9 @@ using content::BrowserThread;
 using content::RenderViewHost;
 using content::ResourceRequestInfo;
 
-// By default we don't allow access to all file:// urls on ChromeOS but we do on
-// other platforms.
-#if defined(OS_CHROMEOS)
+// By default we don't allow access to all file:// urls on ChromeOS and
+// Android.
+#if defined(OS_CHROMEOS) || defined(OS_ANDROID)
 bool ChromeNetworkDelegate::g_allow_file_access_ = false;
 #else
 bool ChromeNetworkDelegate::g_allow_file_access_ = true;
@@ -357,9 +359,17 @@ bool ChromeNetworkDelegate::OnCanAccessFile(const net::URLRequest& request,
   if (g_allow_file_access_)
     return true;
 
+#if !defined(OS_CHROMEOS) && !defined(OS_ANDROID)
+  return true;
+#else
 #if defined(OS_CHROMEOS)
-  // ChromeOS uses a whitelist to only allow access to files residing in the
-  // list of directories below.
+  // If we're running Chrome for ChromeOS on Linux, we want to allow file
+  // access.
+  if (!base::chromeos::IsRunningOnChromeOS())
+    return true;
+
+  // Use a whitelist to only allow access to files residing in the list of
+  // directories below.
   static const char* const kLocalAccessWhiteList[] = {
       "/home/chronos/user/Downloads",
       "/home/chronos/user/log",
@@ -369,12 +379,20 @@ bool ChromeNetworkDelegate::OnCanAccessFile(const net::URLRequest& request,
       "/tmp",
       "/var/log",
   };
-
-  // If we're running Chrome for ChromeOS on Linux, we want to allow file
-  // access.
-  if (!base::chromeos::IsRunningOnChromeOS())
+#elif defined(OS_ANDROID)
+  // Access to files in external storage is allowed.
+  FilePath external_storage_path;
+  PathService::Get(base::DIR_ANDROID_EXTERNAL_STORAGE, &external_storage_path);
+  if (external_storage_path.IsParent(path))
     return true;
 
+  // Whitelist of other allowed directories.
+  static const char* const kLocalAccessWhiteList[] = {
+      "/sdcard",
+      "/mnt/sdcard",
+  };
+#endif
+
   for (size_t i = 0; i < arraysize(kLocalAccessWhiteList); ++i) {
     const FilePath white_listed_path(kLocalAccessWhiteList[i]);
     // FilePath::operator== should probably handle trailing separators.
@@ -383,10 +401,9 @@ bool ChromeNetworkDelegate::OnCanAccessFile(const net::URLRequest& request,
       return true;
     }
   }
+
   return false;
-#else
-  return true;
-#endif  // defined(OS_CHROMEOS)
+#endif  // !defined(OS_CHROMEOS) && !defined(OS_ANDROID)
 }
 
 bool ChromeNetworkDelegate::OnCanThrottleRequest(