From 5ef49809a501c2d5144127f62896e4557567b538 Mon Sep 17 00:00:00 2001
From: Shu Yang <shuyng@google.com>
Date: Thu, 16 Apr 2026 12:36:22 -0700
Subject: [PATCH] Sanitize file extension in DragDataToDropData to prevent path traversal

A compromised renderer could supply a malicious `filename_extension`
containing path traversal characters (e.g., `../../`) during a
drag-and-drop operation. This could potentially allow a sandbox escape
by writing arbitrary files to a vulnerable third-party app.

To fix this, we now use `BaseName()` on the `filename_extension` in
`DragDataToDropData` to strip out any directory components.

We also added a regression test in `render_widget_host_unittest.cc` to
verify that malicious paths are correctly sanitized.

Bug: 497651688
Change-Id: Ic6fcfd598c3bd4a45a88f5218a93e0d80add22f8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7762535
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Commit-Queue: Shu Yang <shuyng@google.com>
Cr-Commit-Position: refs/heads/main@{#1616053}
---

diff --git a/content/browser/renderer_host/data_transfer_util.cc b/content/browser/renderer_host/data_transfer_util.cc
index 38929861..42236d3d 100644
--- a/content/browser/renderer_host/data_transfer_util.cc
+++ b/content/browser/renderer_host/data_transfer_util.cc
@@ -398,7 +398,7 @@
             binary_item->is_image_accessible;
         result.file_contents_source_url = binary_item->source_url;
         result.file_contents_filename_extension =
-            binary_item->filename_extension.value();
+            binary_item->filename_extension.BaseName().value();
         if (binary_item->content_disposition) {
           result.file_contents_content_disposition =
               *binary_item->content_disposition;
diff --git a/content/browser/renderer_host/render_widget_host_unittest.cc b/content/browser/renderer_host/render_widget_host_unittest.cc
index bef04fb..fc7fe932 100644
--- a/content/browser/renderer_host/render_widget_host_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_unittest.cc
@@ -2411,6 +2411,28 @@
   EXPECT_TRUE(drop_data().download_metadata.has_value());
 }
 
+TEST_F(RenderWidgetHostDragTest, SanitizeFilenameExtensionOnDrag) {
+  NavigateAndCommit(GURL("https://example.com"));
+  EXPECT_EQ(start_dragging_count(), 0);
+
+  auto drag_data = blink::mojom::DragData::New();
+  blink::mojom::DragItemBinaryPtr item = blink::mojom::DragItemBinary::New();
+  item->data = mojo_base::BigBuffer(std::vector<uint8_t>{1, 2, 3});
+  item->is_image_accessible = true;
+  item->source_url = GURL("http://example.com/image.png");
+  item->filename_extension =
+      base::FilePath(FILE_PATH_LITERAL("png/../../payload.so"));
+  drag_data->items.push_back(
+      blink::mojom::DragItem::NewBinary(std::move(item)));
+
+  StartDragWithDragData(std::move(drag_data));
+
+  EXPECT_EQ(start_dragging_count(), 1);
+  // BaseName() should strip the path traversal components.
+  EXPECT_EQ(drop_data().file_contents_filename_extension,
+            FILE_PATH_LITERAL("payload.so"));
+}
+
 // Hiding the RenderWidgetHostImpl instance via a call to WasHidden should
 // not reject a pending pointer lock, if the operation is waiting for the
 // user to make a selection on the permission prompt.

diff --git a/content/browser/renderer_host/render_widget_host_unittest.cc b/content/browser/renderer_host/render_widget_host_unittest.cc
index bef04fb..fc7fe932 100644
--- a/content/browser/renderer_host/render_widget_host_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_unittest.cc
@@ -2411,6 +2411,28 @@
   EXPECT_TRUE(drop_data().download_metadata.has_value());
 }
 
+TEST_F(RenderWidgetHostDragTest, SanitizeFilenameExtensionOnDrag) {
+  NavigateAndCommit(GURL("https://example.com"));
+  EXPECT_EQ(start_dragging_count(), 0);
+
+  auto drag_data = blink::mojom::DragData::New();
+  blink::mojom::DragItemBinaryPtr item = blink::mojom::DragItemBinary::New();
+  item->data = mojo_base::BigBuffer(std::vector<uint8_t>{1, 2, 3});
+  item->is_image_accessible = true;
+  item->source_url = GURL("http://example.com/image.png");
+  item->filename_extension =
+      base::FilePath(FILE_PATH_LITERAL("png/../../payload.so"));
+  drag_data->items.push_back(
+      blink::mojom::DragItem::NewBinary(std::move(item)));
+
+  StartDragWithDragData(std::move(drag_data));
+
+  EXPECT_EQ(start_dragging_count(), 1);
+  // BaseName() should strip the path traversal components.
+  EXPECT_EQ(drop_data().file_contents_filename_extension,
+            FILE_PATH_LITERAL("payload.so"));
+}
+
 // Hiding the RenderWidgetHostImpl instance via a call to WasHidden should
 // not reject a pending pointer lock, if the operation is waiting for the
 // user to make a selection on the permission prompt.