[Desktop] webtorrent .torrent file detection security issue

[diracdeltas]

https://hackerone.com/reports/963155

[GeetaSarvadnya]

Verification passed on

Brave | 1.15.50 Chromium: 85.0.4183.102 (Official Build) dev (64-bit)
-- | --
Revision | ffe848af6a5df4fa127e2929331116b7f9f1cb30-refs/branch-heads/4183@{#1770}
OS | Windows 10 OS Version 1903 (Build 18362.1016)

• Verified the test plan from Webtorrent: validate torrent file before downloading brave-core#6531
• Verified that file is not a torrent alert message is displayed upon click on save torrent file

Verification passed on

Brave	1.15.55 Chromium: 85.0.4183.102 (Official Build) dev (64-bit)
Revision	ffe848af6a5df4fa127e2929331116b7f9f1cb30-refs/branch-heads/4183@{#1770}
OS	Ubuntu 18.04 LTS

• Verified the test plan from Webtorrent: validate torrent file before downloading brave-core#6531
• Verified that file when is a torrent:
  
• Verified that file is not a torrent alert message is displayed upon click on save torrent file
  

Verification PASSED on macOS 10.15.6 x64 using the following build:

Brave | 1.15.56 Chromium: 85.0.4183.102 (Official Build) dev (64-bit)
-- | --
Revision | ffe848af6a5df4fa127e2929331116b7f9f1cb30-refs/branch-heads/4183@{#1770}
OS | macOS Version 10.15.6 (Build 19G73)

• Verified the STR/Cases outlined via Webtorrent: validate torrent file before downloading brave-core#6531

Reproduced what @GeetaSarvadnya mentioned via #11488 (comment). Also reproduced/ran into #11302.

[GeetaSarvadnya]

@feross select https://php-demo-app-shibli.cfapps.io/test-driver.php link in URL bar and enter displays save .bat file window. Is this expected?

[kjozwiak]

@diracdeltas as per @GeetaSarvadnya's comment above, you can still download the POC if you paste the following URL into the omnibox rather than clicking on Save .torrent file.

* https://php-demo-app-shibli.cfapps.io/test.php

Assuming that's expected as we're not doing the check for .torrent files via the omnibox. Please let us know if we need to file a follow up to address the above.

[diracdeltas]

@kjozwiak that's fine. thank you!