Disable downloads from "file:" or "data:" URLs.

content/browser/download/download_resource_handler.cc

Index: content/browser/download/download_resource_handler.cc
diff --git a/content/browser/download/download_resource_handler.cc b/content/browser/download/download_resource_handler.cc
index 4aca33f89eccf2d8ce71be8188ce10c9ca489d5b..df82179a18bc0dbc537ab1b9d421455c3ebdaca0 100644
--- a/content/browser/download/download_resource_handler.cc
+++ b/content/browser/download/download_resource_handler.cc
@@ -98,6 +98,12 @@ bool DownloadResourceHandler::OnResponseStarted(
            << " request_id = " << request_id;
   download_start_time_ = base::TimeTicks::Now();
 
+  if (request_->url().scheme() == "file" ||
+      request_->url().scheme() == "data") {
+    CallStartedCB(download_id_, net::ERR_DISALLOWED_URL_SCHEME);
+    return false;
+  }
+
   // If it's a download, we don't want to poison the cache with it.
   request_->StopCaching();