Fix path issue for downloading.

Download LMs based on the lang of IME.
There is a clenaup issue after downloading, check b/143685131

TBR=dvallet@chromium.org,shend@chromium.org
TEST=it-IT,en-GB

Bug: 946913
Change-Id: I2e963f294b603d264fd9577b49e1fd902f6d853a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1893471Reviewed-by: Leo Zhang <googleo@chromium.org>
Commit-Queue: Leo Zhang <googleo@chromium.org>
Auto-Submit: Leo Zhang <googleo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#711271}

chromeos/services/ime/ime_service.cc

@@ -69,7 +69,10 @@ void ImeService::SimpleDownloadFinished(SimpleDownloadCallback callback,
   if (file.empty()) {
     callback(SIMPLE_DOWNLOAD_ERROR_FAILED, "");
   } else {
-    callback(SIMPLE_DOWNLOAD_ERROR_OK, file.MaybeAsASCII().c_str());
+    // Convert downloaded file path to an whitelisted path.
+    base::FilePath target(kUserInputMethodsDirPath);
+    target = target.Append(kLanguageDataDirName).Append(file.BaseName());
+    callback(SIMPLE_DOWNLOAD_ERROR_OK, target.MaybeAsASCII().c_str());
   }
 }
 
@@ -101,11 +104,16 @@ int ImeService::SimpleDownloadToFile(const char* url,
     callback(SIMPLE_DOWNLOAD_ERROR_ABORTED, "");
     LOG(ERROR) << "Failed to download due to missing binding.";
   } else {
+    // Target path MUST be relative for security concerns.
+    // Compose a relative download path beased on the request.
+    base::FilePath initial_path(file_path);
+    base::FilePath relative_path(kInputMethodsDirName);
+    relative_path = relative_path.Append(kLanguageDataDirName)
+                        .Append(initial_path.BaseName());
+
     GURL download_url(url);
-    // |file_path| must be relative.
-    base::FilePath relative_file_path(file_path);
     platform_access_->DownloadImeFileTo(
-        download_url, relative_file_path,
+        download_url, relative_path,
         base::BindOnce(&ImeService::SimpleDownloadFinished,
                        base::Unretained(this), std::move(callback)));
   }