Merge 170159

webkit/fileapi/file_system_directory_database.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/fileapi/file_system_directory_database.h"
 
 #include <math.h>
 #include <algorithm>
 #include <set>
 #include <stack>
@@ skipping 351 matching lines @@
       ++visited_links;
     }
   }
 
   // Check if we've visited all database entries.
   return num_directories_in_db_ == visited_directories &&
       num_files_in_db_ == visited_files &&
       num_hierarchy_links_in_db_ == visited_links;
 }
 
+// Returns true if the given |data_path| contains no parent references ("..")
+// and does not refer to special system files.
+// This is called in GetFileInfo, AddFileInfo and UpdateFileInfo to
+// ensure we're only dealing with valid data paths.
+bool VerifyDataPath(const FilePath& data_path) {
+  // |data_path| should not contain any ".." and should be a relative path
+  // (to the filesystem_data_directory_).
+  if (data_path.ReferencesParent() || data_path.IsAbsolute())
+    return false;
+  // See if it's not pointing to the special system paths.
+  const FilePath kExcludes[] = {
+    FilePath(kDirectoryDatabaseName),
+    FilePath(fileapi::FileSystemUsageCache::kUsageFileName),
+  };
+  for (size_t i = 0; i < arraysize(kExcludes); ++i) {
+    if (data_path == kExcludes[i] || kExcludes[i].IsParent(data_path))
+      return false;
+  }
+  return true;
+}
+
 }  // namespace
 
 namespace fileapi {
 
 FileSystemDirectoryDatabase::FileInfo::FileInfo() : parent_id(0) {
 }
 
 FileSystemDirectoryDatabase::FileInfo::~FileInfo() {
 }
 
@@ skipping 72 matching lines @@
 
 bool FileSystemDirectoryDatabase::GetFileInfo(FileId file_id, FileInfo* info) {
   if (!Init(REPAIR_ON_CORRUPTION))
     return false;
   DCHECK(info);
   std::string file_key = GetFileLookupKey(file_id);
   std::string file_data_string;
   leveldb::Status status =
       db_->Get(leveldb::ReadOptions(), file_key, &file_data_string);
   if (status.ok()) {
-    return FileInfoFromPickle(
+    bool success = FileInfoFromPickle(
         Pickle(file_data_string.data(), file_data_string.length()), info);
+    if (!success)
+      return false;
+    if (!VerifyDataPath(info->data_path)) {
+      LOG(ERROR) << "Resolved data path is invalid: "
+                 << info->data_path.value();
+      return false;
+    }
+    return true;
   }
   // Special-case the root, for databases that haven't been initialized yet.
   // Without this, a query for the root's file info, made before creating the
   // first file in the database, will fail and confuse callers.
   if (status.IsNotFound() && !file_id) {
     info->name = FilePath::StringType();
     info->data_path = FilePath();
     info->modification_time = base::Time::Now();
     info->parent_id = 0;
     return true;
@@ skipping 338 matching lines @@
   if (!info.is_directory()) {
     LOG(ERROR) << "New parent directory is a file!";
     return false;
   }
   return true;
 }
 
 // This does very few safety checks!
 bool FileSystemDirectoryDatabase::AddFileInfoHelper(
     const FileInfo& info, FileId file_id, leveldb::WriteBatch* batch) {
+  if (!VerifyDataPath(info.data_path)) {
+    LOG(ERROR) << "Invalid data path is given: " << info.data_path.value();
+    return false;
+  }
   std::string id_string = GetFileLookupKey(file_id);
   if (!file_id) {
     // The root directory doesn't need to be looked up by path from its parent.
     DCHECK(!info.parent_id);
     DCHECK(info.data_path.empty());
   } else {
     std::string child_key = GetChildLookupKey(info.parent_id, info.name);
     batch->Put(child_key, id_string);
   }
   Pickle pickle;
@@ skipping 30 matching lines @@
 
 void FileSystemDirectoryDatabase::HandleError(
     const tracked_objects::Location& from_here,
     const leveldb::Status& status) {
   LOG(ERROR) << "FileSystemDirectoryDatabase failed at: "
              << from_here.ToString() << " with error: " << status.ToString();
   db_.reset();
 }
 
 }  // namespace fileapi