File manager: support for zipping selected files.

chrome/utility/chrome_content_utility_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/utility/chrome_content_utility_client.h"
 
 #include "base/base64.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/json/json_reader.h"
 #include "base/memory/ref_counted.h"
 #include "base/message_loop_proxy.h"
 #include "base/threading/thread.h"
 #include "chrome/browser/importer/importer.h"
 #include "chrome/browser/importer/profile_import_process_messages.h"
 #include "chrome/common/child_process_logging.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_utility_messages.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_l10n_util.h"
 #include "chrome/common/extensions/unpacker.h"
 #include "chrome/common/extensions/update_manifest.h"
 #include "chrome/common/web_resource/web_resource_unpacker.h"
+#include "chrome/common/zip.h"
 #include "chrome/utility/profile_import_handler.h"
 #include "content/public/utility/utility_thread.h"
 #include "printing/backend/print_backend.h"
 #include "printing/page_range.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/base/ui_base_switches.h"
 #include "ui/gfx/codec/jpeg_codec.h"
 #include "ui/gfx/rect.h"
 #include "webkit/glue/image_decoder.h"
 
@@ skipping 47 matching lines @@
                         OnParseUpdateManifest)
     IPC_MESSAGE_HANDLER(ChromeUtilityMsg_DecodeImage, OnDecodeImage)
     IPC_MESSAGE_HANDLER(ChromeUtilityMsg_DecodeImageBase64, OnDecodeImageBase64)
     IPC_MESSAGE_HANDLER(ChromeUtilityMsg_RenderPDFPagesToMetafile,
                         OnRenderPDFPagesToMetafile)
     IPC_MESSAGE_HANDLER(ChromeUtilityMsg_RobustJPEGDecodeImage,
                         OnRobustJPEGDecodeImage)
     IPC_MESSAGE_HANDLER(ChromeUtilityMsg_ParseJSON, OnParseJSON)
     IPC_MESSAGE_HANDLER(ChromeUtilityMsg_GetPrinterCapsAndDefaults,
                         OnGetPrinterCapsAndDefaults)
+    IPC_MESSAGE_HANDLER(ChromeUtilityMsg_CreateZipFile, OnCreateZipFile)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
 
 #if !defined(OS_ANDROID)
   if (!handled)
     handled = import_handler_->OnMessageReceived(message);
 #endif
 
   return handled;
 }
@@ skipping 78 matching lines @@
   }
 
   std::vector<unsigned char> decoded_vector(decoded_string.size());
   for (size_t i = 0; i < decoded_string.size(); ++i) {
     decoded_vector[i] = static_cast<unsigned char>(decoded_string[i]);
   }
 
   OnDecodeImage(decoded_vector);
 }
 
+void ChromeContentUtilityClient::OnCreateZipFile(
+    const FilePath& src_dir,
+    const std::vector<FilePath>& src_relative_paths,
+    const FilePath& dest_file) {
+  if (zip::ZipFiles(src_dir, src_relative_paths, dest_file))

[palmer, 2012/11/13 20:43:40]

As it is, this function looks very dangerous.

zip::ZipFiles does no validation of the pathnames. As you say in
chrome/common/zip.cc,

178   // TODO(hshi): check that |src_relative_paths| does not contain
|dest_file|.

I'd also add that you should enforce that src_relative_paths are, in fact,
relative to src_dir.

Additionally, we need to make sure this is not an arbitrary file-write primitive
(e.g. one that overwrites existing, believed-trustworthy zip files, or any other
files).

This message-receiving code should determine |dest_file| itself; or,
alternately, validate |dest_file| strictly and then incorporate it into the
final pathanme as a suggestion from the caller. For example (in pseudocode):

    dest_file = strip_non_ascii(dest_file);
    dest_file = basename(dest_file);
    dest_file = strip_extension(dest_file);
    dest_file = strip_spaces(dest_file);
    dest_file = kZipFilesParent + kDirectorySeparator + dest_file + ".zip";

It should probably pass zip::ZipFiles an open HANDLE or file descriptor, rather
than a pathname, to avoid race conditions and name collisions. That probably
requires a new function overload for zip::ZipFiles.

    dest_descriptor = open(dest_file, O_CREAT|O_EXCL|O_TRUNC|O_WRONLY, 0644); 
// And whatever is appropriate for Windows

Similarly, there should be something like:

    foreach (pathname in src_relative_paths) {
        pathname = normalize_pathname(pathname);  // No "../" tricks, et c.
        if (is_absolute_path(pathname))
            fail();
        validated_src_paths.push_back(pathname);
    }

    zip::ZipFiles(src_dir, validated_src_paths, dest_descriptor);

+    Send(new ChromeUtilityHostMsg_CreateZipFile_Succeeded());
+  else
+    Send(new ChromeUtilityHostMsg_CreateZipFile_Failed());
+  content::UtilityThread::Get()->ReleaseProcessIfNeeded();
+}
+
 void ChromeContentUtilityClient::OnRenderPDFPagesToMetafile(
     base::PlatformFile pdf_file,
     const FilePath& metafile_path,
     const printing::PdfRenderSettings& pdf_render_settings,
     const std::vector<printing::PageRange>& page_ranges) {
   bool succeeded = false;
 #if defined(OS_WIN)
   int highest_rendered_page_number = 0;
   double scale_factor = 1.0;
   succeeded = RenderPDFToWinMetafile(pdf_file,
@@ skipping 208 matching lines @@
   } else
 #endif
   {
     Send(new ChromeUtilityHostMsg_GetPrinterCapsAndDefaults_Failed(
         printer_name));
   }
   content::UtilityThread::Get()->ReleaseProcessIfNeeded();
 }
 
 }  // namespace chrome