Disable downloads from "file:" or "data:" URLs.

content/browser/download/download_resource_handler.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/download/download_resource_handler.h"
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/logging.h"
@@ skipping 80 matching lines @@
 }
 
 // Send the download creation information to the download thread.
 bool DownloadResourceHandler::OnResponseStarted(
     int request_id,
     content::ResourceResponse* response) {
   VLOG(20) << __FUNCTION__ << "()" << DebugString()
            << " request_id = " << request_id;
   download_start_time_ = base::TimeTicks::Now();
 
+  if (request_->url().scheme() == "file" ||
+      request_->url().scheme() == "data") {
+    CallStartedCB(download_id_, net::ERR_DISALLOWED_URL_SCHEME);

[ahendrickson, 2012/03/20 19:56:35]

Should we be doing a test at the time when we determine that a link should be
downloaded?

[Randy Smith (Not in Mondays), 2012/03/21 19:48:36]

Andy and I talked offline, and agreed that doing it in a single place that any
download (either current or future) needed to go through was preferable to
having multiple test locations, even if that would avoid creating the
DownloadResourceHandler.  I may look into putting this in OnWillStart(), if that
can be made to work.

+    return false;
+  }
+
   // If it's a download, we don't want to poison the cache with it.
   request_->StopCaching();
 
   std::string content_disposition;
   request_->GetResponseHeaderByName("content-disposition",
                                     &content_disposition);
   set_content_disposition(content_disposition);
   set_content_length(response->content_length);
 
   const ResourceRequestInfoImpl* request_info =
@@ skipping 318 matching lines @@
                             " }",
                             request_ ?
                                 request_->url().spec().c_str() :
                                 "<NULL request>",
                             download_id_.local(),
                             global_id_.child_id,
                             global_id_.request_id,
                             render_view_id_,
                             save_info_.file_path.value().c_str());
 }