Merge pull request #2100 from brave/francois-2766-mark-of-the-web

Remove source and referrer URLs from download metadata
brave · Apr 1, 2019 · 2db7da8 · 2db7da8
2 parents b094c4d + d3be795
commit 2db7da8
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/patches/components-download-internal-common-download_item_impl.cc.patch b/patches/components-download-internal-common-download_item_impl.cc.patch
@@ -0,0 +1,15 @@
+diff --git a/components/download/internal/common/download_item_impl.cc b/components/download/internal/common/download_item_impl.cc
+index 4b536f504a4cd61aefb1efcc42e5de801586d62b..24c153bd00a14d6215ff5798f290e7845b328c2c 100644
+--- a/components/download/internal/common/download_item_impl.cc
++++ b/components/download/internal/common/download_item_impl.cc
+@@ -1680,8 +1680,8 @@ void DownloadItemImpl::OnDownloadCompleting() {
+                      base::Unretained(download_file_.get()),
+                      GetTargetFilePath(),
+                      delegate_->GetApplicationClientIdForFileScanning(),
+-                     delegate_->IsOffTheRecord() ? GURL() : GetURL(),
+-                     delegate_->IsOffTheRecord() ? GURL() : GetReferrerUrl(),
++                     GURL(),  // Never leak download URLs in metadata.
++                     GURL(),  // See brave-browser#2766.
+                      std::move(callback)));
+ }
+