| Index: shell/application_manager/network_fetcher.cc
|
| diff --git a/shell/application_manager/network_fetcher.cc b/shell/application_manager/network_fetcher.cc
|
| index 05aba7ab3605b5837b5acdb53e789b03f50c0246..c1fa5fb248f7a11ee2c21a7e3f89298eed80dc85 100644
|
| --- a/shell/application_manager/network_fetcher.cc
|
| +++ b/shell/application_manager/network_fetcher.cc
|
| @@ -87,7 +87,8 @@ void NetworkFetcher::RecordCacheToURLMapping(const base::FilePath& path,
|
|
|
| // AppIds should be be both predictable and unique, but any hash would work.
|
| // Currently we use sha256 from crypto/secure_hash.h
|
| -bool NetworkFetcher::ComputeAppId(const base::FilePath& path,
|
| +bool NetworkFetcher::ComputeAppId(const GURL& canonical_url,
|
| + const base::FilePath& path,
|
| std::string* digest_string) {
|
| scoped_ptr<crypto::SecureHash> ctx(
|
| crypto::SecureHash::Create(crypto::SecureHash::SHA256));
|
| @@ -96,6 +97,11 @@ bool NetworkFetcher::ComputeAppId(const base::FilePath& path,
|
| LOG(ERROR) << "Failed to open " << path.value() << " for computing AppId";
|
| return false;
|
| }
|
| + std::string spec = canonical_url.spec();
|
| + uint32_t len = static_cast<uint32_t>(spec.size());
|
| + // Prevent URL vs. content spoofing.
|
| + ctx->Update(&len, sizeof(len));
|
| + ctx->Update(spec.c_str(), spec.size());
|
| char buf[1024];
|
| while (file.IsValid()) {
|
| int bytes_read = file.ReadAtCurrentPos(buf, sizeof(buf));
|
| @@ -116,10 +122,11 @@ bool NetworkFetcher::ComputeAppId(const base::FilePath& path,
|
| return true;
|
| }
|
|
|
| -bool NetworkFetcher::RenameToAppId(const base::FilePath& old_path,
|
| +bool NetworkFetcher::RenameToAppId(const GURL& canonical_url,
|
| + const base::FilePath& old_path,
|
| base::FilePath* new_path) {
|
| std::string app_id;
|
| - if (!ComputeAppId(old_path, &app_id))
|
| + if (!ComputeAppId(canonical_url, old_path, &app_id))
|
| return false;
|
|
|
| base::FilePath temp_dir;
|
| @@ -136,7 +143,7 @@ void NetworkFetcher::CopyCompleted(
|
| if (success) {
|
| success = false;
|
| base::FilePath new_path;
|
| - if (RenameToAppId(path_, &new_path)) {
|
| + if (RenameToAppId(GURL(response_->url), path_, &new_path)) {
|
| if (base::PathExists(new_path)) {
|
| path_ = new_path;
|
| success = true;
|
|
|