Restrict file access on android.

chrome/browser/net/chrome_network_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/net/chrome_network_delegate.h"
 
 #include "base/logging.h"
+#include "base/base_paths.h"
+#include "base/path_service.h"
 #include "chrome/browser/api/prefs/pref_member.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/content_settings/cookie_settings.h"
 #include "chrome/browser/content_settings/tab_specific_content_settings.h"
 #include "chrome/browser/custom_handlers/protocol_handler_registry.h"
 #include "chrome/browser/extensions/api/proxy/proxy_api.h"
 #include "chrome/browser/extensions/api/web_request/web_request_api.h"
 #include "chrome/browser/extensions/event_router_forwarder.h"
 #include "chrome/browser/extensions/extension_info_map.h"
 #include "chrome/browser/extensions/extension_process_manager.h"
@@ skipping 26 matching lines @@
 #endif
 
 #if defined(ENABLE_CONFIGURATION_POLICY)
 #include "chrome/browser/policy/url_blacklist_manager.h"
 #endif
 
 using content::BrowserThread;
 using content::RenderViewHost;
 using content::ResourceRequestInfo;
 
-// By default we don't allow access to all file:// urls on ChromeOS but we do on
-// other platforms.
-#if defined(OS_CHROMEOS)
+// By default we don't allow access to all file:// urls on ChromeOS and
+// Android.
+#if defined(OS_CHROMEOS) || defined(OS_ANDROID)
 bool ChromeNetworkDelegate::g_allow_file_access_ = false;
 #else
 bool ChromeNetworkDelegate::g_allow_file_access_ = true;
 #endif
 
 // This remains false unless the --disable-extensions-http-throttling
 // flag is passed to the browser.
 bool ChromeNetworkDelegate::g_never_throttle_requests_ = false;
 
 namespace {
@@ skipping 283 matching lines @@
   }
 
   return allow;
 }
 
 bool ChromeNetworkDelegate::OnCanAccessFile(const net::URLRequest& request,
                                             const FilePath& path) const {
   if (g_allow_file_access_)
     return true;
 
+#if defined(OS_CHROMEOS) || defined(OS_ANDROID)

[willchan no longer on Chromium, 2012/09/06 00:20:15]

How about doing:

#if !defined(OS_CHROME) && !defined(OS_ANDROID)
  return true;
#else

[nilesh, 2012/09/06 00:26:14]

Done.

 #if defined(OS_CHROMEOS)
-  // ChromeOS uses a whitelist to only allow access to files residing in the
-  // list of directories below.
+  // If we're running Chrome for ChromeOS on Linux, we want to allow file
+  // access.
+  if (!base::chromeos::IsRunningOnChromeOS())
+    return true;
+
+  // Use a whitelist to only allow access to files residing in the list of
+  // directories below.
   static const char* const kLocalAccessWhiteList[] = {
       "/home/chronos/user/Downloads",
       "/home/chronos/user/log",
       "/media",
       "/opt/oem",
       "/usr/share/chromeos-assets",
       "/tmp",
       "/var/log",
   };
+#endif

[willchan no longer on Chromium, 2012/09/06 00:20:15]

Combine the #endif and #if into a #elif?

[nilesh, 2012/09/06 00:26:14]

Done.

+#if defined(OS_ANDROID)
+  // Access to files in external storage is allowed.
+  FilePath external_storage_path;
+  PathService::Get(base::DIR_ANDROID_EXTERNAL_STORAGE, &external_storage_path);
+  if (external_storage_path.IsParent(path))
+    return true;
 
-  // If we're running Chrome for ChromeOS on Linux, we want to allow file
-  // access.
-  if (!base::chromeos::IsRunningOnChromeOS())
-    return true;
+  // Whitelist of other allowed directories.
+  static const char* const kLocalAccessWhiteList[] = {
+      "/sdcard",
+      "/mnt/sdcard",
+  };
+#endif
 
   for (size_t i = 0; i < arraysize(kLocalAccessWhiteList); ++i) {
     const FilePath white_listed_path(kLocalAccessWhiteList[i]);
     // FilePath::operator== should probably handle trailing separators.
     if (white_listed_path == path.StripTrailingSeparators() ||
         white_listed_path.IsParent(path)) {
       return true;
     }
   }
+
   return false;
 #else
   return true;
-#endif  // defined(OS_CHROMEOS)
+#endif  // defined(OS_CHROMEOS) || defined(OS_ANDROID)
 }
 
 bool ChromeNetworkDelegate::OnCanThrottleRequest(
     const net::URLRequest& request) const {
   if (g_never_throttle_requests_) {
     return false;
   }
 
   return request.first_party_for_cookies().scheme() ==
       chrome::kExtensionScheme;
@@ skipping 15 matching lines @@
 #endif
   return net::OK;
 }
 
 void ChromeNetworkDelegate::OnRequestWaitStateChange(
     const net::URLRequest& request,
     RequestWaitState state) {
   if (load_time_stats_)
     load_time_stats_->OnRequestWaitStateChange(request, state);
 }