From 81e76165ae3be27dd630d434e722083d3ceba0c9 Mon Sep 17 00:00:00 2001
From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com>
Date: Wed, 15 Apr 2026 21:55:17 -0500
Subject: [PATCH] fix: allow PDF viewer to show save file picker (#51072)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The PDF viewer's "save with changes" feature uses
`window.showSaveFilePicker()`, but the PDF extension runs in a
cross-origin iframe (chrome-extension:// inside the app's origin).
Chromium's File System Access API blocks cross-origin subframes from
showing file pickers unless the embedder explicitly allows them via
`ContentClient::IsFilePickerAllowedForCrossOriginSubframe()`.

Chrome overrides this in `ChromeContentClient` to allowlist the PDF
extension origin, but Electron never did — so the picker was always
blocked with a SecurityError.

This adds the same override to `ElectronContentClient`, allowing the
built-in PDF extension origin to bypass the cross-origin check.

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
---
 shell/app/electron_content_client.cc | 10 ++++++++++
 shell/app/electron_content_client.h  |  3 +++
 2 files changed, 13 insertions(+)

diff --git a/shell/app/electron_content_client.cc b/shell/app/electron_content_client.cc
index e6fb2f3f7b..ee91e67058 100644
--- a/shell/app/electron_content_client.cc
+++ b/shell/app/electron_content_client.cc
@@ -32,6 +32,7 @@
 
 #if BUILDFLAG(ENABLE_PDF_VIEWER)
 #include "components/pdf/common/constants.h"  // nogncheck
+#include "components/pdf/common/pdf_util.h"   // nogncheck
 #include "shell/common/electron_constants.h"
 #endif  // BUILDFLAG(ENABLE_PDF_VIEWER)
 
@@ -217,4 +218,13 @@ void ElectronContentClient::AddContentDecryptionModules(
   }
 }
 
+bool ElectronContentClient::IsFilePickerAllowedForCrossOriginSubframe(
+    const url::Origin& origin) {
+#if BUILDFLAG(ENABLE_PDF_VIEWER)
+  return IsPdfExtensionOrigin(origin);
+#else
+  return false;
+#endif
+}
+
 }  // namespace electron
diff --git a/shell/app/electron_content_client.h b/shell/app/electron_content_client.h
index f833881b77..3c38e45ea5 100644
--- a/shell/app/electron_content_client.h
+++ b/shell/app/electron_content_client.h
@@ -9,6 +9,7 @@
 #include <vector>
 
 #include "content/public/common/content_client.h"
+#include "url/origin.h"
 
 namespace electron {
 
@@ -33,6 +34,8 @@ class ElectronContentClient : public content::ContentClient {
   void AddContentDecryptionModules(
       std::vector<content::CdmInfo>* cdms,
       std::vector<media::CdmHostFilePath>* cdm_host_file_paths) override;
+  bool IsFilePickerAllowedForCrossOriginSubframe(
+      const url::Origin& origin) override;
 };
 
 }  // namespace electron