Allow whitelisted bundles to load in Chrome

chrome/common/mac/cfbundle_blocker.mm

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/mac/cfbundle_blocker.h"
 
 #include <CoreFoundation/CoreFoundation.h>
 #import <Foundation/Foundation.h>
 
 #include "base/logging.h"
 #include "base/mac/mac_util.h"
 #include "base/mac/scoped_cftyperef.h"
 #include "base/mac/scoped_nsautorelease_pool.h"
+#import "base/memory/scoped_nsobject.h"
 #include "base/sys_string_conversions.h"
 #include "third_party/mach_override/mach_override.h"
 
 extern "C" {
 
 // _CFBundleLoadExecutableAndReturnError is the internal implementation that
 // results in a dylib being loaded via dlopen. Both CFBundleLoadExecutable and
 // CFBundleLoadExecutableAndReturnError are funneled into this routine. Other
 // CFBundle functions may also call directly into here, perhaps due to
 // inlining their calls to CFBundleLoadExecutable.
@@ skipping 29 matching lines @@
     NSArray* blocked_prefixes =
        NSSearchPathForDirectoriesInDomains(NSLibraryDirectory,
                                            NSUserDomainMask |
                                                NSLocalDomainMask |
                                                NSNetworkDomainMask,
                                            YES);
 
     // Everything in the suffix list has a trailing slash so as to only block
     // loading things contained in these directories.
     NSString* const blocked_suffixes[] = {
-      // SIMBL - http://code.google.com/p/simbl/source/browse/src/SIMBL.{h,m}.
-      // It attempts to inject itself via an AppleScript event.
-      // http://code.google.com/p/simbl/source/browse/SIMBL%20Agent/SIMBLAgent.m
-      // Blocking input managers and scripting additions may already be enough
-      // to prevent SIMBL plugins from loading.
-      @"Application Support/SIMBL/Plugins/",
-
 #if !defined(__LP64__)
       // Contextual menu manager plug-ins are unavailable to 64-bit processes.
       // http://developer.apple.com/library/mac/releasenotes/Cocoa/AppKitOlderNotes.html#NSMenu
       // Contextual menu plug-ins are loaded when a contextual menu is opened,
       // for example, from within
       // +[NSMenu popUpContextMenu:withEvent:forView:].
       @"Contextual Menu Items/",
 
       // Input managers are deprecated, would only be loaded under specific
       // circumstances, and are entirely unavailable to 64-bit processes.
@@ skipping 59 matching lines @@
       // If bundle_path is inside blocked_path (it has blocked_path as a
       // prefix), refuse to load it.
       return true;
     }
   }
 
   // bundle_path is not inside any blocked_path from blocked_paths.
   return false;
 }
 
-// Returns true if bundle_id identifies a bundle that is allowed to be loaded
-// even when found in a blocked directory.
-bool IsBundleIDAllowed(NSString* bundle_id) {
-  return [bundle_id isEqualToString:@"com.google.osax.Google_Authenticator_BT"];
-}
-
 typedef Boolean (*_CFBundleLoadExecutableAndReturnError_Type)(CFBundleRef,
                                                               Boolean,
                                                               CFErrorRef*);
 
 // Call this to execute the original implementation of
 // _CFBundleLoadExecutableAndReturnError.
 _CFBundleLoadExecutableAndReturnError_Type
     g_original_underscore_cfbundle_load_executable_and_return_error;
 
 Boolean ChromeCFBundleLoadExecutableAndReturnError(CFBundleRef bundle,
                                                    Boolean force_global,
                                                    CFErrorRef* error) {
   base::mac::ScopedNSAutoreleasePool autorelease_pool;
 
   DCHECK(g_original_underscore_cfbundle_load_executable_and_return_error);
 
   base::mac::ScopedCFTypeRef<CFURLRef> url_cf(CFBundleCopyBundleURL(bundle));
-  base::mac::ScopedCFTypeRef<CFStringRef> path_cf(
-      CFURLCopyFileSystemPath(url_cf, kCFURLPOSIXPathStyle));
-  NSString* path_ns = base::mac::CFToNSCast(path_cf);
+  scoped_nsobject<NSString> path(base::mac::CFToNSCast(
+      CFURLCopyFileSystemPath(url_cf, kCFURLPOSIXPathStyle)));
 
-  CFStringRef identifier_cf = CFBundleGetIdentifier(bundle);
-  NSString* identifier_ns = base::mac::CFToNSCast(identifier_cf);
+  NSString* bundle_id = base::mac::CFToNSCast(CFBundleGetIdentifier(bundle));
 
-  if (IsBundlePathBlocked(path_ns) && !IsBundleIDAllowed(identifier_ns)) {
-    NSString* identifier_ns_print = identifier_ns ? identifier_ns : @"(nil)";
+  NSDictionary* bundle_dictionary =
+      base::mac::CFToNSCast(CFBundleGetInfoDictionary(bundle));
+  NSString* version = [bundle_dictionary objectForKey:
+      base::mac::CFToNSCast(kCFBundleVersionKey)];
+  if (![version isKindOfClass:[NSString class]]) {
+    // Deal with pranksters.
+    version = nil;
+  }
+
+  if (IsBundlePathBlocked(path) && !IsBundleAllowed(bundle_id, version)) {
+    NSString* bundle_id_print = bundle_id ? bundle_id : @"(nil)";
+    NSString* version_print = version ? version : @"(nil)";
 
     LOG(INFO) << "Blocking attempt to load bundle "
-              << [identifier_ns_print UTF8String]
+              << [bundle_id_print UTF8String]
+              << " version "
+              << [version_print UTF8String]
               << " at "
-              << [path_ns fileSystemRepresentation];
+              << [path fileSystemRepresentation];

[Scott Hess - ex-Googler, 2011/10/13 00:05:54]

Wonder if this would be cleaner using -[NSString stringWithFormat:] to format
all the OSX stuff together, then one big -UTF8String to log it.   You shouldn't
have added mods, here :-).

[Mark Mentovai, 2011/10/13 03:23:15]

shess wrote:
That’d be sorta technically incorrect around the -fileSystemRepresentation bit,
and anyway, this is what LOG(…) << … << …; was born for.

You’re right, I shouldn’t have touched it. :)

 
     if (error) {
-      base::mac::ScopedCFTypeRef<CFStringRef> bundle_id(
+      base::mac::ScopedCFTypeRef<CFStringRef> app_bundle_id(
           base::SysUTF8ToCFStringRef(base::mac::BaseBundleID()));
 
       // 0xb10c10ad = "block load"
       const CFIndex kBundleLoadBlocked = 0xb10c10ad;
 
       NSMutableDictionary* error_dict =
-          [NSMutableDictionary dictionaryWithCapacity:3];
-      if (identifier_ns) {
-        [error_dict setObject:identifier_ns forKey:@"identifier"];
+          [NSMutableDictionary dictionaryWithCapacity:4];
+      if (bundle_id) {
+        [error_dict setObject:bundle_id forKey:@"bundle_id"];
       }
-      if (path_ns) {
-        [error_dict setObject:path_ns forKey:@"path"];
+      if (version) {
+        [error_dict setObject:version forKey:@"version"];
+      }
+      if (path) {
+        [error_dict setObject:path forKey:@"path"];
       }
       NSURL* url_ns = base::mac::CFToNSCast(url_cf);
-      NSString* url_absolute_string_ns = [url_ns absoluteString];
-      if (url_absolute_string_ns) {
-        [error_dict setObject:url_absolute_string_ns forKey:@"url"];
+      NSString* url_absolute_string = [url_ns absoluteString];
+      if (url_absolute_string) {
+        [error_dict setObject:url_absolute_string forKey:@"url"];
       }
 
       *error = CFErrorCreate(NULL,
-                             bundle_id,
+                             app_bundle_id,
                              kBundleLoadBlocked,
                              base::mac::NSToCFCast(error_dict));
     }
 
     return FALSE;
   }
 
   // Not blocked. Call through to the original implementation.
   return g_original_underscore_cfbundle_load_executable_and_return_error(
       bundle, force_global, error);
 }
 
 }  // namespace
 
 void EnableCFBundleBlocker() {
   mach_error_t err = mach_override_ptr(
       reinterpret_cast<void*>(_CFBundleLoadExecutableAndReturnError),
       reinterpret_cast<void*>(ChromeCFBundleLoadExecutableAndReturnError),
       reinterpret_cast<void**>(
           &g_original_underscore_cfbundle_load_executable_and_return_error));
   if (err != err_none) {
     LOG(WARNING) << "mach_override _CFBundleLoadExecutableAndReturnError: "
                  << err;
   }
 }
 
+namespace {
+
+struct AllowedBundle {
+  // The bundle identifier to permit. These are matched with a case-sensitive
+  // literal comparison. "Children" of the declared bundle ID are permitted:
+  // if bundle_id here is @"org.chromium", it would match both @"org.chromium"
+  // and @"org.chromium.Chromium".
+  NSString* bundle_id;
+
+  // If bundle_id should only be permitted as of a certain minimum version,
+  // this string defines that version, which will be compared to the bundle's
+  // version with a numeric comparison. If bundle_id may be permitted at any
+  // version, set minimum_version to nil.
+  NSString* minimum_version;
+};
+
+}  // namespace
+
+bool IsBundleAllowed(NSString* bundle_id, NSString* version) {
+  // The list of bundles that are allowed to load. Before adding an entry to
+  // this list, be sure that it's well-behaved. Specifically, anything that
+  // uses mach_override
+  // (https://github.com/rentzsch/mach_star/tree/master/mach_override) must
+  // use version 51ae3d199463fa84548f466d649f0821d579fdaf (July 22, 2011) or
+  // newer. Products added to the list must not cause crashes. Entries should
+  // include the name of the product, URL, and the name and e-mail address of
+  // someone responsible for the product's engineering. To add items to this
+  // list, file a bug at http://new.crbug.com/ using the "Defect on Mac OS"
+  // template, and provide the bundle ID (or IDs) and minimum CFBundleVersion
+  // that's safe for Chrome to load, along with the necessary product and
+  // contact information. Whitelisted bundles in this list may be removed if
+  // they are found to cause instability or otherwise behave badly. With
+  // proper contact information, Chrome developers may try to contact
+  // maintainers to resolve any problems.
+  const AllowedBundle kAllowedBundles[] = {
+    // Google Authenticator BT
+    // Dave MacLachlan <dmaclach@google.com>
+    { @"com.google.osax.Google_Authenticator_BT", nil },
+
+    // Default Folder X, http://www.stclairsoft.com/DefaultFolderX/
+    // Jon Gotow <gotow@stclairsoft.com>
+    { @"com.stclairsoft.DefaultFolderX", @"4.4.3" },
+
+    // MySpeed, http://www.enounce.com/myspeed
+    // Edward Bianchi <ejbianchi@enounce.com>
+    { @"com.enounce.MySpeed.osax", @"1201" },
+
+    // SIMBL (fork), https://github.com/albertz/simbl
+    // Albert Zeyer <albzey@googlemail.com>
+    { @"net.culater.SIMBL", nil },
+
+    // Smart Scroll, http://marcmoini.com/sx_en.html
+    // Marc Moini <marc@a9ff.com>
+    { @"com.marcmoini.SmartScroll", @"3.9" },
+  };
+
+  for (size_t index = 0; index < arraysize(kAllowedBundles); ++index) {
+    const AllowedBundle& allowed_bundle = kAllowedBundles[index];
+    NSString* allowed_bundle_id = allowed_bundle.bundle_id;
+    NSUInteger allowed_bundle_id_length = [allowed_bundle_id length];
+
+    // Permit bundle identifiers that are exactly equal to the allowed
+    // identifier, as well as "children" of the allowed identifier.
+    if ([bundle_id isEqualToString:allowed_bundle_id] ||
+        ([bundle_id length] > allowed_bundle_id_length &&
+         [bundle_id characterAtIndex:allowed_bundle_id_length] == '.' &&
+         [bundle_id hasPrefix:allowed_bundle_id])) {
+      NSString* minimum_version = allowed_bundle.minimum_version;
+      if (!minimum_version) {
+        // If the rule didn't declare any version requirement, the bundle is
+        // allowed to load.
+        return true;
+      }
+
+      if (!version) {
+        // If there wasn't any version but one was required, the bundle isn't
+        // allowed to load.
+        return false;
+      }
+
+      // A numeric search is appropriate for comparing version numbers.
+      NSComparisonResult result = [version compare:minimum_version
+                                           options:NSNumericSearch];
+      return result != NSOrderedAscending;
+    }
+  }
+
+  // Nothing matched.
+  return false;
+}
+
 }  // namespace mac
 }  // namespace common
 }  // namespace chrome