Improve validation of external extension ids.

chrome/browser/extensions/external_extension_provider_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/external_extension_provider_impl.h"
 
 #include "app/app_paths.h"
 #include "base/file_path.h"
 #include "base/logging.h"
 #include "base/linked_ptr.h"
@@ skipping 51 matching lines @@
   if (!service_) return;
 
   prefs_.reset(prefs);
   ready_ = true; // Queries for extensions are allowed from this point.
 
   // Notify ExtensionService about all the extensions this provider has.
   for (DictionaryValue::key_iterator i = prefs_->begin_keys();
        i != prefs_->end_keys(); ++i) {
     const std::string& extension_id = *i;
     DictionaryValue* extension;
-    if (!prefs_->GetDictionaryWithoutPathExpansion(extension_id, &extension))
+
+    if (!Extension::IdIsValid(extension_id)) {
+      LOG(WARNING) << "Malformed extension dictionary: key "
+                   << extension_id.c_str() << " is not a valid id.";
       continue;
+    }
+
+    if (!prefs_->GetDictionaryWithoutPathExpansion(extension_id, &extension)) {
+      LOG(WARNING) << "Malformed extension dictionary: key "
+                   << extension_id.c_str()
+                   << " has a value that is not a dictionary.";
+      continue;
+    }
 
     FilePath::StringType external_crx;
     std::string external_version;
     std::string external_update_url;
 
     bool has_external_crx = extension->GetString(kExternalCrx, &external_crx);
     bool has_external_version = extension->GetString(kExternalVersion,
                                                      &external_version);
     bool has_external_update_url = extension->GetString(kExternalUpdateUrl,
                                                         &external_update_url);
@@ skipping 47 matching lines @@
     } else { // if (has_external_update_url)
       CHECK(has_external_update_url);  // Checking of keys above ensures this.
       if (download_location_ == Extension::INVALID) {
         LOG(WARNING) << "This provider does not support installing external "
                      << "extensions from update URLs.";
         continue;
       }
       GURL update_url(external_update_url);
       if (!update_url.is_valid()) {
         LOG(WARNING) << "Malformed extension dictionary for extension: "
-                     << extension_id.c_str() << ".  " << kExternalUpdateUrl
-                     << " must be a valid URL.  Saw \"" << external_update_url
-                     << "\".";
+                     << extension_id.c_str() << ".  Key " << kExternalUpdateUrl
+                     << " has value \"" << external_update_url
+                     << "\", which is not a valid URL.";
         continue;
       }
       service_->OnExternalExtensionUpdateUrlFound(
           extension_id, update_url, download_location_);
     }
   }
 
   service_->OnExternalProviderReady();
 }
 
@@ skipping 70 matching lines @@
               Extension::INVALID)));
 #endif
   provider_list->push_back(
       linked_ptr<ExternalExtensionProviderInterface>(
           new ExternalExtensionProviderImpl(
               service,
               new ExternalPolicyExtensionLoader(profile),
               Extension::INVALID,
               Extension::EXTERNAL_POLICY_DOWNLOAD)));
 }