Give the extension unpacker process a junction/symlink free path to the unpack directory.

chrome/browser/extensions/sandboxed_extension_unpacker.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/sandboxed_extension_unpacker.h"
 
 #include <set>
 
 #include "base/base64.h"
 #include "base/crypto/signature_verifier.h"
@@ skipping 46 matching lines @@
   if (!ValidateSignature())
     return;  // ValidateSignature() already reported the error.
 
   // Copy the crx file into our working directory.
   FilePath temp_crx_path = temp_dir_.path().Append(crx_path_.BaseName());
   if (!file_util::CopyFile(crx_path_, temp_crx_path)) {
     ReportFailure("Failed to copy extension file to temporary directory.");
     return;
   }
 
-  // If we are supposed to use a subprocess, copy the crx to the temp directory
-  // and kick off the subprocess.
+  // The utility process will have access to the directory passed to
+  // SandboxedExtensionUnpacker.  That directory should not contain a
+  // symlink or NTFS junction, because when the path is used, following
+  // the link will cause file system access outside the sandbox path.
+  FilePath normalized_crx_path;
+  if (!file_util::NormalizeFilePath(temp_crx_path, &normalized_crx_path)) {
+    // TODO(skerner): Remove this logging once crbug/13044 is fixed.
+    // This bug is starred by many users who have some kind of link.
+    // If NormalizeFilePath() fails we want to see it in the logs they send.
+    LOG(ERROR) << "Could not get the normalized path of "
+               << temp_crx_path.value();
+    normalized_crx_path = temp_crx_path;
+  } else {
+    LOG(INFO) << "RealFilePath: from " << temp_crx_path.value()
+              << " to " << normalized_crx_path.value();
+  }
+
+  // If we are supposed to use a subprocess, kick off the subprocess.
   //
   // TODO(asargent) we shouldn't need to do this branch here - instead
   // UtilityProcessHost should handle it for us. (http://crbug.com/19192)
   bool use_utility_process = rdh_ &&
       !CommandLine::ForCurrentProcess()->HasSwitch(switches::kSingleProcess);
   if (use_utility_process) {
     ChromeThread::PostTask(
         ChromeThread::IO, FROM_HERE,
         NewRunnableMethod(
             this,
             &SandboxedExtensionUnpacker::StartProcessOnIOThread,
-            temp_crx_path));
+            normalized_crx_path));
   } else {
     // Otherwise, unpack the extension in this process.
-    ExtensionUnpacker unpacker(temp_crx_path);
+    ExtensionUnpacker unpacker(normalized_crx_path);
     if (unpacker.Run() && unpacker.DumpImagesToFile() &&
         unpacker.DumpMessageCatalogsToFile()) {
       OnUnpackExtensionSucceeded(*unpacker.parsed_manifest());
     } else {
       OnUnpackExtensionFailed(unpacker.error_message());
     }
   }
 }
 
 void SandboxedExtensionUnpacker::StartProcessOnIOThread(
@@ skipping 309 matching lines @@
     if (!file_util::WriteFile(path,
                               catalog_json.c_str(),
                               catalog_json.size())) {
       ReportFailure("Error saving catalog.");
       return false;
     }
   }
 
   return true;
 }