Index: net/base/net_util.cc |
diff --git a/net/base/net_util.cc b/net/base/net_util.cc |
index 097da238ed2acf6d2ba5123f8ddab72a5fe57d93..ef8eb534d12792c4ae76978f1425470acce9cd00 100644 |
--- a/net/base/net_util.cc |
+++ b/net/base/net_util.cc |
@@ -64,6 +64,7 @@ |
#include "grit/net_resources.h" |
#include "net/base/dns_util.h" |
#include "net/base/escape.h" |
+#include "net/base/mime_util.h" |
#include "net/base/net_module.h" |
#if defined(OS_WIN) |
#include "net/base/winsock_init.h" |
@@ -921,6 +922,112 @@ char* do_strdup(const char* src) { |
#endif |
} |
+#if defined(OS_WIN) |
+// Returns whether the specified extension is automatically integrated into the |
+// windows shell. |
+bool IsShellIntegratedExtension(const string16& extension) { |
+ string16 extension_lower = StringToLowerASCII(extension); |
+ |
+ static const wchar_t* const integrated_extensions[] = { |
+ // See <http://msdn.microsoft.com/en-us/library/ms811694.aspx>. |
+ L"local", |
+ // Right-clicking on shortcuts can be magical. |
+ L"lnk", |
+ }; |
+ |
+ for (int i = 0; i < arraysize(integrated_extensions); ++i) { |
+ if (extension_lower == integrated_extensions[i]) |
+ return true; |
+ } |
+ |
+ // See <http://www.juniper.net/security/auto/vulnerabilities/vuln2612.html>. |
+ // That vulnerability report is not exactly on point, but files become magical |
+ // if their end in a CLSID. Here we block extensions that look like CLSIDs. |
+ if (!extension_lower.empty() && extension_lower[0] == L'{' && |
+ extension_lower[extension_lower.length() - 1] == L'}') |
+ return true; |
+ |
+ return false; |
+} |
+ |
+// Returns whether the specified file name is a reserved name on windows. |
+// This includes names like "com2.zip" (which correspond to devices) and |
+// desktop.ini and thumbs.db which have special meaning to the windows shell. |
+bool IsReservedName(const string16& filename) { |
+ // This list is taken from the MSDN article "Naming a file" |
+ // http://msdn2.microsoft.com/en-us/library/aa365247(VS.85).aspx |
+ // I also added clock$ because GetSaveFileName seems to consider it as a |
+ // reserved name too. |
+ static const wchar_t* const known_devices[] = { |
+ L"con", L"prn", L"aux", L"nul", L"com1", L"com2", L"com3", L"com4", L"com5", |
+ L"com6", L"com7", L"com8", L"com9", L"lpt1", L"lpt2", L"lpt3", L"lpt4", |
+ L"lpt5", L"lpt6", L"lpt7", L"lpt8", L"lpt9", L"clock$" |
+ }; |
+ string16 filename_lower = StringToLowerASCII(filename); |
+ |
+ for (int i = 0; i < arraysize(known_devices); ++i) { |
+ // Exact match. |
+ if (filename_lower == known_devices[i]) |
+ return true; |
+ // Starts with "DEVICE.". |
+ if (filename_lower.find(string16(known_devices[i]) + L".") == 0) |
+ return true; |
+ } |
+ |
+ static const wchar_t* const magic_names[] = { |
+ // These file names are used by the "Customize folder" feature of the shell. |
+ L"desktop.ini", |
+ L"thumbs.db", |
+ }; |
+ |
+ for (int i = 0; i < arraysize(magic_names); ++i) { |
+ if (filename_lower == magic_names[i]) |
+ return true; |
+ } |
+ |
+ return false; |
+} |
+#endif // OS_WIN |
+ |
+void GenerateSafeExtension(const std::string& mime_type, FilePath* file_name) { |
+ // We're worried about two things here: |
+ // |
+ // 1) Usability. If the site fails to provide a file extension, we want to |
+ // guess a reasonable file extension based on the content type. |
+ // |
+ // 2) Shell integration. Some file extensions automatically integrate with |
+ // the shell. We block these extensions to prevent a malicious web site |
+ // from integrating with the user's shell. |
+ |
+ // See if our file name already contains an extension. |
+ FilePath::StringType extension = file_name->Extension(); |
+ if (!extension.empty()) |
+ extension.erase(extension.begin()); // Erase preceding '.'. |
+ |
+#if defined(OS_WIN) |
+ static const FilePath::CharType default_extension[] = |
+ FILE_PATH_LITERAL("download"); |
+ |
+ // Rename shell-integrated extensions. |
+ // TODO(asanka): Consider stripping out the bad extension and replacing it |
+ // with the preferred extension for the MIME type if one is available. |
+ if (IsShellIntegratedExtension(extension)) |
+ extension.assign(default_extension); |
+#endif |
+ |
+ if (extension.empty() && !mime_type.empty()) { |
+ // The GetPreferredExtensionForMimeType call will end up going to disk. Do |
+ // this on another thread to avoid slowing the IO thread. |
+ // http://crbug.com/61827 |
+ // TODO(asanka): Remove this ScopedAllowIO once all callers have switched |
+ // over to IO safe threads. |
+ base::ThreadRestrictions::ScopedAllowIO allow_io; |
+ net::GetPreferredExtensionForMimeType(mime_type, &extension); |
+ } |
+ |
+ *file_name = file_name->ReplaceExtension(extension); |
+} |
+ |
} // namespace |
const FormatUrlType kFormatUrlOmitNothing = 0; |
@@ -968,7 +1075,7 @@ GURL FilePathToFileURL(const FilePath& path) { |
} |
std::string GetSpecificHeader(const std::string& headers, |
- const std::string& name) { |
+ const std::string& name) { |
// We want to grab the Value from the "Key: Value" pairs in the headers, |
// which should look like this (no leading spaces, \n-separated) (we format |
// them this way in url_request_inet.cc): |
@@ -1248,6 +1355,26 @@ string16 StripWWW(const string16& text) { |
return StartsWith(text, www, true) ? text.substr(www.length()) : text; |
} |
+void GenerateSafeFileName(const std::string& mime_type, FilePath* file_path) { |
+ // Make sure we get the right file extension |
+ GenerateSafeExtension(mime_type, file_path); |
+ |
+#if defined(OS_WIN) |
+ // Prepend "_" to the file name if it's a reserved name |
+ FilePath::StringType leaf_name = file_path->BaseName().value(); |
+ DCHECK(!leaf_name.empty()); |
+ if (IsReservedName(leaf_name)) { |
+ leaf_name = FilePath::StringType(FILE_PATH_LITERAL("_")) + leaf_name; |
+ *file_path = file_path->DirName(); |
+ if (file_path->value() == FilePath::kCurrentDirectory) { |
+ *file_path = FilePath(leaf_name); |
+ } else { |
+ *file_path = file_path->Append(leaf_name); |
+ } |
+ } |
+#endif |
+} |
+ |
string16 GetSuggestedFilename(const GURL& url, |
const std::string& content_disposition, |
const std::string& referrer_charset, |
@@ -1348,6 +1475,35 @@ string16 GetSuggestedFilename(const GURL& url, |
#endif |
} |
+FilePath GenerateFileName(const GURL& url, |
+ const std::string& content_disposition, |
+ const std::string& referrer_charset, |
+ const std::string& suggested_name, |
+ const std::string& mime_type, |
+ const string16& default_file_name) { |
+ string16 new_name = GetSuggestedFilename(GURL(url), |
+ content_disposition, |
+ referrer_charset, |
+ suggested_name, |
+ default_file_name); |
+ |
+ // TODO(evan): this code is totally wrong -- we should just generate |
+ // Unicode filenames and do all this encoding switching at the end. |
+ // However, I'm just shuffling wrong code around, at least not adding |
+ // to it. |
+#if defined(OS_WIN) |
+ FilePath generated_name = FilePath(new_name); |
+#else |
+ FilePath generated_name = FilePath( |
+ base::SysWideToNativeMB(UTF16ToWide(new_name))); |
+#endif |
+ |
+ DCHECK(!generated_name.empty()); |
+ |
+ GenerateSafeFileName(mime_type, &generated_name); |
+ return generated_name; |
+} |
+ |
bool IsPortAllowedByDefault(int port) { |
int array_size = arraysize(kRestrictedPorts); |
for (int i = 0; i < array_size; i++) { |