From ebee769e5e2e914e34b4ce20f956863d62bb7c3b Mon Sep 17 00:00:00 2001
From: Alesandro Ortiz <[email protected]>
Date: Fri, 25 Jul 2025 16:46:32 -0700
Subject: [PATCH] Clear `default_file_name` for non-save file pickers.

This only affects file pickers opened by renderer. This code path is
used by file-type inputs.

Bug: 433800617
Change-Id: Ia144bda955fdd4b827448e49ebd051d48dd7dbf7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6786387
Reviewed-by: Austin Sullivan <[email protected]>
Reviewed-by: Charlie Reis <[email protected]>
Reviewed-by: Mustafa Emre Acer <[email protected]>
Commit-Queue: Alesandro Ortiz <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1492358}
---

diff --git a/content/browser/web_contents/file_chooser_impl.cc b/content/browser/web_contents/file_chooser_impl.cc
index 75db7b5..7104add 100644
--- a/content/browser/web_contents/file_chooser_impl.cc
+++ b/content/browser/web_contents/file_chooser_impl.cc
@@ -170,6 +170,12 @@
     return;
   }
 
+  // Do not allow open dialogs to have renderer-controlled default_file_name.
+  // See https://crbug.com/433800617 for context.
+  if (params->mode != blink::mojom::FileChooserParams::Mode::kSave) {
+    params->default_file_name = base::FilePath();
+  }
+
   // Don't allow page with open FileChooser to enter BackForwardCache to avoid
   // any unexpected behaviour from BackForwardCache.
   BackForwardCache::DisableForRenderFrameHost(
diff --git a/content/browser/web_contents/file_chooser_impl_unittest.cc b/content/browser/web_contents/file_chooser_impl_unittest.cc
new file mode 100644
index 0000000..c736462
--- /dev/null
+++ b/content/browser/web_contents/file_chooser_impl_unittest.cc
@@ -0,0 +1,122 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_contents/file_chooser_impl.h"
+
+#include "base/files/file_path.h"
+#include "base/run_loop.h"
+#include "content/browser/renderer_host/render_frame_host_impl.h"
+#include "content/public/browser/web_contents_delegate.h"
+#include "content/test/test_web_contents.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using ::testing::_;
+using ::testing::Invoke;
+
+namespace content {
+
+class MockWebContentsDelegateForFileChooser : public WebContentsDelegate {
+ public:
+  // Mock the method to inspect the parameters it receives.
+  MOCK_METHOD(void,
+              RunFileChooser,
+              (RenderFrameHost* render_frame_host,
+               scoped_refptr<FileSelectListener> listener,
+               const blink::mojom::FileChooserParams& params),
+              (override));
+};
+
+class FileChooserImplTest : public RenderViewHostTestHarness {
+ public:
+  void SetUp() override {
+    RenderViewHostTestHarness::SetUp();
+    mock_web_contents_delegate_ =
+        std::make_unique<MockWebContentsDelegateForFileChooser>();
+    auto test_web_contents =
+        TestWebContents::Create(browser_context(), nullptr);
+    test_web_contents->SetDelegate(mock_web_contents_delegate_.get());
+    SetContents(std::move(test_web_contents));
+
+    // Navigate to page, otherwise OpenFileChooser() returns early.
+    NavigateAndCommit(GURL(url::kAboutBlankURL));
+  }
+
+  void TearDown() override {
+    mock_web_contents_delegate_.reset();
+    RenderViewHostTestHarness::TearDown();
+  }
+
+ protected:
+  std::unique_ptr<MockWebContentsDelegateForFileChooser>
+      mock_web_contents_delegate_;
+};
+
+TEST_F(FileChooserImplTest, DefaultFileNameClearedWhenModeIsNotSave) {
+  FileChooserImpl* file_chooser_impl =
+      FileChooserImpl::CreateForTesting(
+          static_cast<RenderFrameHostImpl*>(main_rfh()))
+          .first;
+
+  auto params = blink::mojom::FileChooserParams::New();
+  params->mode = blink::mojom::FileChooserParams::Mode::kOpen;
+  const base::FilePath kInitialFile =
+      base::FilePath(FILE_PATH_LITERAL("file.txt"));
+  params->default_file_name = kInitialFile;
+
+  blink::mojom::FileChooserParamsPtr captured_params;
+  EXPECT_CALL(*mock_web_contents_delegate_, RunFileChooser(_, _, _))
+      .WillOnce(Invoke(
+          [&](RenderFrameHost* rfh, scoped_refptr<FileSelectListener> listener,
+              const blink::mojom::FileChooserParams& passed_params) {
+            // Capture the arguments for later inspection.
+            captured_params = passed_params.Clone();
+
+            // Avoid logging error on destruction in test.
+            static_cast<FileChooserImpl::FileSelectListenerImpl*>(
+                listener.get())
+                ->SetListenerFunctionCalledTrueForTesting();
+          }));
+
+  file_chooser_impl->OpenFileChooser(std::move(params), base::DoNothing());
+
+  // Verify the default file name was cleared.
+  ASSERT_TRUE(captured_params);
+  EXPECT_EQ(captured_params->default_file_name, base::FilePath());
+}
+
+TEST_F(FileChooserImplTest, DefaultFileNamePreservedWhenModeIsSave) {
+  FileChooserImpl* file_chooser_impl =
+      FileChooserImpl::CreateForTesting(
+          static_cast<RenderFrameHostImpl*>(main_rfh()))
+          .first;
+
+  auto params = blink::mojom::FileChooserParams::New();
+  params->mode = blink::mojom::FileChooserParams::Mode::kSave;
+  const base::FilePath kInitialFile =
+      base::FilePath(FILE_PATH_LITERAL("file.txt"));
+  params->default_file_name = kInitialFile;
+
+  blink::mojom::FileChooserParamsPtr captured_params;
+  EXPECT_CALL(*mock_web_contents_delegate_, RunFileChooser(_, _, _))
+      .WillOnce(Invoke(
+          [&](RenderFrameHost* rfh, scoped_refptr<FileSelectListener> listener,
+              const blink::mojom::FileChooserParams& passed_params) {
+            // Capture the arguments for later inspection.
+            captured_params = passed_params.Clone();
+
+            // Avoid logging error on destruction in test.
+            static_cast<FileChooserImpl::FileSelectListenerImpl*>(
+                listener.get())
+                ->SetListenerFunctionCalledTrueForTesting();
+          }));
+
+  file_chooser_impl->OpenFileChooser(std::move(params), base::DoNothing());
+
+  // Verify the default file name was preserved.
+  ASSERT_TRUE(captured_params);
+  EXPECT_EQ(captured_params->default_file_name, kInitialFile);
+}
+
+}  // namespace content
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index 4c4b74ad4..1e0218fe 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -2891,6 +2891,7 @@
     "../browser/tracing/tracing_scenario_unittest.cc",
     "../browser/usb/web_usb_service_impl_unittest.cc",
     "../browser/web_contents/aura/gesture_nav_simple_unittest.cc",
+    "../browser/web_contents/file_chooser_impl_unittest.cc",
     "../browser/web_contents/web_contents_delegate_unittest.cc",
     "../browser/web_contents/web_contents_impl_unittest.cc",
     "../browser/web_contents/web_contents_user_data_unittest.cc",
diff --git a/third_party/blink/public/mojom/choosers/file_chooser.mojom b/third_party/blink/public/mojom/choosers/file_chooser.mojom
index 411e5aee..c7929be 100644
--- a/third_party/blink/public/mojom/choosers/file_chooser.mojom
+++ b/third_party/blink/public/mojom/choosers/file_chooser.mojom
@@ -31,7 +31,7 @@
     kOpenDirectory,
 
     // Allows picking a nonexistent file, and prompts to overwrite if the file
-    // already exists. This is not for Blink but for PPAPI.
+    // already exists.
     kSave,
   };
   Mode mode = kOpen;
@@ -40,7 +40,8 @@
   // which will be either "Open" or "Save" depending on the mode.
   mojo_base.mojom.String16 title;
 
-  // Default file name to select in the dialog with kSave mode.
+  // Default file name to select in the dialog with kSave mode. This value
+  // is cleared if mode is not kSave.
   mojo_base.mojom.FilePath default_file_name;
 
   // |selected_files| has filenames which a file upload control already

diff --git a/content/browser/web_contents/file_chooser_impl_unittest.cc b/content/browser/web_contents/file_chooser_impl_unittest.cc
new file mode 100644
index 0000000..c736462
--- /dev/null
+++ b/content/browser/web_contents/file_chooser_impl_unittest.cc
@@ -0,0 +1,122 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_contents/file_chooser_impl.h"
+
+#include "base/files/file_path.h"
+#include "base/run_loop.h"
+#include "content/browser/renderer_host/render_frame_host_impl.h"
+#include "content/public/browser/web_contents_delegate.h"
+#include "content/test/test_web_contents.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using ::testing::_;
+using ::testing::Invoke;
+
+namespace content {
+
+class MockWebContentsDelegateForFileChooser : public WebContentsDelegate {
+ public:
+  // Mock the method to inspect the parameters it receives.
+  MOCK_METHOD(void,
+              RunFileChooser,
+              (RenderFrameHost* render_frame_host,
+               scoped_refptr<FileSelectListener> listener,
+               const blink::mojom::FileChooserParams& params),
+              (override));
+};
+
+class FileChooserImplTest : public RenderViewHostTestHarness {
+ public:
+  void SetUp() override {
+    RenderViewHostTestHarness::SetUp();
+    mock_web_contents_delegate_ =
+        std::make_unique<MockWebContentsDelegateForFileChooser>();
+    auto test_web_contents =
+        TestWebContents::Create(browser_context(), nullptr);
+    test_web_contents->SetDelegate(mock_web_contents_delegate_.get());
+    SetContents(std::move(test_web_contents));
+
+    // Navigate to page, otherwise OpenFileChooser() returns early.
+    NavigateAndCommit(GURL(url::kAboutBlankURL));
+  }
+
+  void TearDown() override {
+    mock_web_contents_delegate_.reset();
+    RenderViewHostTestHarness::TearDown();
+  }
+
+ protected:
+  std::unique_ptr<MockWebContentsDelegateForFileChooser>
+      mock_web_contents_delegate_;
+};
+
+TEST_F(FileChooserImplTest, DefaultFileNameClearedWhenModeIsNotSave) {
+  FileChooserImpl* file_chooser_impl =
+      FileChooserImpl::CreateForTesting(
+          static_cast<RenderFrameHostImpl*>(main_rfh()))
+          .first;
+
+  auto params = blink::mojom::FileChooserParams::New();
+  params->mode = blink::mojom::FileChooserParams::Mode::kOpen;
+  const base::FilePath kInitialFile =
+      base::FilePath(FILE_PATH_LITERAL("file.txt"));
+  params->default_file_name = kInitialFile;
+
+  blink::mojom::FileChooserParamsPtr captured_params;
+  EXPECT_CALL(*mock_web_contents_delegate_, RunFileChooser(_, _, _))
+      .WillOnce(Invoke(
+          [&](RenderFrameHost* rfh, scoped_refptr<FileSelectListener> listener,
+              const blink::mojom::FileChooserParams& passed_params) {
+            // Capture the arguments for later inspection.
+            captured_params = passed_params.Clone();
+
+            // Avoid logging error on destruction in test.
+            static_cast<FileChooserImpl::FileSelectListenerImpl*>(
+                listener.get())
+                ->SetListenerFunctionCalledTrueForTesting();
+          }));
+
+  file_chooser_impl->OpenFileChooser(std::move(params), base::DoNothing());
+
+  // Verify the default file name was cleared.
+  ASSERT_TRUE(captured_params);
+  EXPECT_EQ(captured_params->default_file_name, base::FilePath());
+}
+
+TEST_F(FileChooserImplTest, DefaultFileNamePreservedWhenModeIsSave) {
+  FileChooserImpl* file_chooser_impl =
+      FileChooserImpl::CreateForTesting(
+          static_cast<RenderFrameHostImpl*>(main_rfh()))
+          .first;
+
+  auto params = blink::mojom::FileChooserParams::New();
+  params->mode = blink::mojom::FileChooserParams::Mode::kSave;
+  const base::FilePath kInitialFile =
+      base::FilePath(FILE_PATH_LITERAL("file.txt"));
+  params->default_file_name = kInitialFile;
+
+  blink::mojom::FileChooserParamsPtr captured_params;
+  EXPECT_CALL(*mock_web_contents_delegate_, RunFileChooser(_, _, _))
+      .WillOnce(Invoke(
+          [&](RenderFrameHost* rfh, scoped_refptr<FileSelectListener> listener,
+              const blink::mojom::FileChooserParams& passed_params) {
+            // Capture the arguments for later inspection.
+            captured_params = passed_params.Clone();
+
+            // Avoid logging error on destruction in test.
+            static_cast<FileChooserImpl::FileSelectListenerImpl*>(
+                listener.get())
+                ->SetListenerFunctionCalledTrueForTesting();
+          }));
+
+  file_chooser_impl->OpenFileChooser(std::move(params), base::DoNothing());
+
+  // Verify the default file name was preserved.
+  ASSERT_TRUE(captured_params);
+  EXPECT_EQ(captured_params->default_file_name, kInitialFile);
+}
+
+}  // namespace content
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index 4c4b74ad4..1e0218fe 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -2891,6 +2891,7 @@
     "../browser/tracing/tracing_scenario_unittest.cc",
     "../browser/usb/web_usb_service_impl_unittest.cc",
     "../browser/web_contents/aura/gesture_nav_simple_unittest.cc",
+    "../browser/web_contents/file_chooser_impl_unittest.cc",
     "../browser/web_contents/web_contents_delegate_unittest.cc",
     "../browser/web_contents/web_contents_impl_unittest.cc",
     "../browser/web_contents/web_contents_user_data_unittest.cc",