Merge 169949 - Fix directory traversal in extension_resources.cc. Adds test case, which is complic…

chrome/common/extensions/extension_resource_unittest.cc

Index: chrome/common/extensions/extension_resource_unittest.cc
===================================================================
--- chrome/common/extensions/extension_resource_unittest.cc	(revision 170581)
+++ chrome/common/extensions/extension_resource_unittest.cc	(working copy)
@@ -49,6 +49,8 @@
 
   FilePath inner_dir = temp.path().AppendASCII("directory");
   ASSERT_TRUE(file_util::CreateDirectory(inner_dir));
+  FilePath sub_dir = inner_dir.AppendASCII("subdir");
+  ASSERT_TRUE(file_util::CreateDirectory(sub_dir));
   FilePath inner_file = inner_dir.AppendASCII("inner");
   FilePath outer_file = temp.path().AppendASCII("outer");
   ASSERT_TRUE(file_util::WriteFile(outer_file, "X", 1));
@@ -86,6 +88,16 @@
   r4.set_follow_symlinks_anywhere();
   EXPECT_TRUE(r4.GetFilePath().empty());
 
+  // ... and not even when clever current-directory syntax is present. Note
+  // that the path for this test case can't start with the current directory
+  // component due to quirks in FilePath::Append(), and the path must exist.
+  ExtensionResource r4a(
+      extension_id, inner_dir,
+      FilePath().AppendASCII("subdir").AppendASCII(".").AppendASCII("..").
+      AppendASCII("..").AppendASCII("outer"));
+  r4a.set_follow_symlinks_anywhere();
+  EXPECT_TRUE(r4a.GetFilePath().empty());
+
 #if defined(OS_POSIX)
   // The non-packing extension should also not be able to access a resource that
   // symlinks out of the directory.