Improve desktop shortcut creation:

chrome/browser/shell_integration_linux.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/shell_integration.h"
 
 #include <fcntl.h>
 #include <stdlib.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include <string>
 #include <vector>
 
 #include "base/command_line.h"
+#include "base/eintr_wrapper.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/message_loop.h"
 #include "base/path_service.h"
 #include "base/process_util.h"
 #include "base/scoped_temp_dir.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
 #include "base/task.h"
 #include "base/thread.h"
@@ skipping 83 matching lines @@
   CreateDesktopShortcutTask(const ShellIntegration::ShortcutInfo& shortcut_info)
       : shortcut_info_(shortcut_info) {
   }
 
   virtual void Run() {
     // TODO(phajdan.jr): Report errors from this function, possibly as infobars.
     std::string template_contents;
     if (!GetDesktopShortcutTemplate(&template_contents))
       return;
 
-    std::string contents = ShellIntegration::GetDesktopFileContents(
-        template_contents, shortcut_info_.url, shortcut_info_.title);
-
-    ScopedTempDir temp_dir;
-    if (!temp_dir.CreateUniqueTempDir())
-      return;
-
     FilePath shortcut_filename =
         ShellIntegration::GetDesktopShortcutFilename(shortcut_info_.url);
 
+    std::string contents = ShellIntegration::GetDesktopFileContents(
+        template_contents, shortcut_info_.url, shortcut_info_.title);
+
+    if (shortcut_info_.create_on_desktop)
+      CreateOnDesktop(shortcut_filename, contents);
+
+    if (shortcut_info_.create_in_applications_menu)
+      CreateInApplicationsMenu(shortcut_filename, contents);
+  }
+
+ private:
+  void CreateOnDesktop(const FilePath& shortcut_filename,
+                       const std::string& contents) {
+    // TODO(phajdan.jr): Report errors from this function, possibly as infobars.
+
+    // Make sure that we will later call openat in a secure way.
+    DCHECK_EQ(shortcut_filename.BaseName().value(), shortcut_filename.value());
+
+    FilePath desktop_path;
+    if (!PathService::Get(chrome::DIR_USER_DESKTOP, &desktop_path))
+      return;
+
+    int desktop_fd = open(desktop_path.value().c_str(), O_RDONLY | O_DIRECTORY);
+    if (desktop_fd < 0)
+      return;
+
+    int fd = openat(desktop_fd, shortcut_filename.value().c_str(),
+                    O_CREAT | O_EXCL | O_WRONLY,
+                    S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
+    if (fd < 0) {
+      HANDLE_EINTR(close(desktop_fd));
+      return;
+    }
+
+    ssize_t bytes_written = file_util::WriteFileDescriptor(fd, contents.data(),
+                                                           contents.length());
+    HANDLE_EINTR(close(fd));
+
+    if (bytes_written != static_cast<ssize_t>(contents.length())) {
+      // Delete the file. No shortuct is better than corrupted one. Use unlinkat
+      // to make sure we're deleting the file in the directory we think we are.
+      // Even if an attacker manager to put something other at
+      // |shortcut_filename| we'll just undo his action.
+      unlinkat(desktop_fd, shortcut_filename.value().c_str(), 0);
+    }
+
+    HANDLE_EINTR(close(desktop_fd));
+  }
+
+  void CreateInApplicationsMenu(const FilePath& shortcut_filename,
+                                const std::string& contents) {
+    // TODO(phajdan.jr): Report errors from this function, possibly as infobars.
+    ScopedTempDir temp_dir;
+    if (!temp_dir.CreateUniqueTempDir())
+      return;
+
     FilePath temp_file_path = temp_dir.path().Append(shortcut_filename);
 
     int bytes_written = file_util::WriteFile(temp_file_path, contents.data(),
                                              contents.length());
 
     if (bytes_written != static_cast<int>(contents.length()))
         return;
 
-    if (shortcut_info_.create_on_desktop) {
-      FilePath desktop_path;
-      if (!PathService::Get(chrome::DIR_USER_DESKTOP, &desktop_path))
-        return;
-      desktop_path = desktop_path.Append(shortcut_filename);
+    std::vector<std::string> argv;
+    argv.push_back("xdg-desktop-menu");
+    argv.push_back("install");
 
-      if (!file_util::PathExists(desktop_path))
-        file_util::CopyFile(temp_file_path, desktop_path);
-    }
+    // Always install in user mode, even if someone runs the browser as root
+    // (people do that).
+    argv.push_back("--mode");
+    argv.push_back("user");
 
-    if (shortcut_info_.create_in_applications_menu) {
-      std::vector<std::string> argv;
-      argv.push_back("xdg-desktop-menu");
-      argv.push_back("install");
-
-      // Always install in user mode, even if someone runs the browser as root
-      // (people do that).
-      argv.push_back("--mode");
-      argv.push_back("user");
-
-      argv.push_back(temp_file_path.value());
-      LaunchXdgUtility(argv);
-    }
+    argv.push_back(temp_file_path.value());
+    LaunchXdgUtility(argv);
   }
 
- private:
   const ShellIntegration::ShortcutInfo shortcut_info_;
 
   DISALLOW_COPY_AND_ASSIGN(CreateDesktopShortcutTask);
 };
 
 }  // namespace
 
 // We delegate the difficulty of setting the default browser in Linux desktop
 // environments to a new xdg utility, xdg-settings. We have to include a copy of
 // it for this to work, obviously, but that's actually the suggested approach
@@ skipping 45 matching lines @@
 
   // Return BaseName to be absolutely sure we're not vulnerable to a directory
   // traversal attack.
   return FilePath::FromWStringHack(filename).BaseName();
 }
 
 std::string ShellIntegration::GetDesktopFileContents(
     const std::string& template_contents, const GURL& url,
     const string16& title) {
   // See http://standards.freedesktop.org/desktop-entry-spec/latest/
-  std::string output_buffer;
+  // Although not required by the spec, Nautilus on Ubuntu Karmic creates its
+  // launchers with an xdg-open shebang. Follow that convention.
+  std::string output_buffer("#!/usr/bin/env xdg-open\n");
   StringTokenizer tokenizer(template_contents, "\n");
   while (tokenizer.GetNext()) {
     // TODO(phajdan.jr): Add the icon.
 
     if (tokenizer.token().substr(0, 5) == "Exec=") {
       std::string exec_path = tokenizer.token().substr(5);
       StringTokenizer exec_tokenizer(exec_path, " ");
       std::string final_path;
       while (exec_tokenizer.GetNext()) {
         if (exec_tokenizer.token() != "%U")
           final_path += exec_tokenizer.token() + " ";
       }
       std::wstring app_switch_wide(switches::kApp);
       std::string app_switch(StringPrintf("\"--%s=%s\"",
                                           WideToUTF8(app_switch_wide).c_str(),
                                           url.spec().c_str()));
+      // Sanitize the command line string.
       ReplaceSubstringsAfterOffset(&app_switch, 0, "%", "%%");
+      ReplaceSubstringsAfterOffset(&app_switch, 0, ";", "");
+      ReplaceSubstringsAfterOffset(&app_switch, 0, "$", "");
       output_buffer += std::string("Exec=") + final_path + app_switch + "\n";
     } else if (tokenizer.token().substr(0, 5) == "Name=") {
       std::string final_title = UTF16ToUTF8(title);
       // Make sure no endline characters can slip in and possibly introduce
       // additional lines (like Exec, which makes it a security risk). Also
       // use the URL as a default when the title is empty.
       if (final_title.empty() ||
           final_title.find("\n") != std::string::npos ||
           final_title.find("\r") != std::string::npos)
         final_title = url.spec();
       output_buffer += StringPrintf("Name=%s\n", final_title.c_str());
-    } else if (tokenizer.token().substr(0, 8) == "Comment=") {
-      // Skip the line.
+    } else if (tokenizer.token().substr(0, 11) == "GenericName" ||
+               tokenizer.token().substr(0, 7) == "Comment" ||
+               tokenizer.token().substr(0, 1) == "#") {
+      // Skip comment lines.
     } else {
       output_buffer += tokenizer.token() + "\n";
     }
   }
   return output_buffer;
 }
 
 void ShellIntegration::CreateDesktopShortcut(
     const ShortcutInfo& shortcut_info) {
   g_browser_process->file_thread()->message_loop()->PostTask(FROM_HERE,
       new CreateDesktopShortcutTask(shortcut_info));
 }