[Downloads] Prevent dangerous files from being opened automatically.

chrome/browser/download/download_prefs.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/download/download_prefs.h"
 
 #include <string>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 144 matching lines @@
   save_file_path_.Init(prefs::kSaveFileDefaultDirectory, prefs);
   save_file_type_.Init(prefs::kSaveFileType, prefs);
 
   // We store any file extension that should be opened automatically at
   // download completion in this pref.
   std::string extensions_to_open =
       prefs->GetString(prefs::kDownloadExtensionsToOpen);
   std::vector<std::string> extensions;
   base::SplitString(extensions_to_open, ':', &extensions);
 
-  for (size_t i = 0; i < extensions.size(); ++i) {
+  for (const auto& extension_string : extensions) {
 #if defined(OS_POSIX)
-    base::FilePath path(extensions[i]);
+    base::FilePath::StringType extension = extension_string;
 #elif defined(OS_WIN)
-    base::FilePath path(base::UTF8ToWide(extensions[i]));
+    base::FilePath::StringType extension = base::UTF8ToWide(extension_string);
 #endif
-    if (!extensions[i].empty() &&
-        download_util::GetFileDangerLevel(path) == download_util::NOT_DANGEROUS)
-      auto_open_.insert(path.value());
+    // If it's empty or malformed or not allowed to open automatically, then
+    // skip the entry. Any such entries will be dropped from preferences the
+    // next time SaveAutoOpenState() is called.
+    if (extension.empty() ||
+        *extension.begin() == base::FilePath::kExtensionSeparator)
+      continue;
+    // Construct something like ".<extension>", since
+    // IsAllowedToOpenAutomatically() needs a filename.
+    base::FilePath filename_with_extension = base::FilePath(
+        base::FilePath::StringType(1, base::FilePath::kExtensionSeparator) +
+        extension);
+
+    // Note that the list of file types that are not allowed to open
+    // automatically can change in the future. When the list is tightened, it is
+    // expected that some entries in the users' auto open list will get dropped
+    // permanently as a result.
+    if (download_util::IsAllowedToOpenAutomatically(filename_with_extension))
+      auto_open_.insert(extension);
   }
 }
 
 DownloadPrefs::~DownloadPrefs() {}
 
 // static
 void DownloadPrefs::RegisterProfilePrefs(
     user_prefs::PrefRegistrySyncable* registry) {
   registry->RegisterBooleanPref(
       prefs::kPromptForDownload,
@@ skipping 100 matching lines @@
   base::FilePath::StringType extension = path.Extension();
   if (extension.empty())
     return false;
   DCHECK(extension[0] == base::FilePath::kExtensionSeparator);
   extension.erase(0, 1);
 #if defined(OS_WIN) || defined(OS_LINUX) || \
     (defined(OS_MACOSX) && !defined(OS_IOS))
   if (extension == FILE_PATH_LITERAL("pdf") && ShouldOpenPdfInSystemReader())
     return true;
 #endif
+
   return auto_open_.find(extension) != auto_open_.end();
 }
 
 bool DownloadPrefs::EnableAutoOpenBasedOnExtension(
     const base::FilePath& file_name) {
   base::FilePath::StringType extension = file_name.Extension();
-  if (extension.empty())
+  if (!download_util::IsAllowedToOpenAutomatically(file_name))
     return false;
+
   DCHECK(extension[0] == base::FilePath::kExtensionSeparator);
   extension.erase(0, 1);
 
   auto_open_.insert(extension);
   SaveAutoOpenState();
   return true;
 }
 
 void DownloadPrefs::DisableAutoOpenBasedOnExtension(
     const base::FilePath& file_name) {
@@ skipping 52 matching lines @@
     extensions.erase(extensions.size() - 1);
 
   profile_->GetPrefs()->SetString(prefs::kDownloadExtensionsToOpen, extensions);
 }
 
 bool DownloadPrefs::AutoOpenCompareFunctor::operator()(
     const base::FilePath::StringType& a,
     const base::FilePath::StringType& b) const {
   return base::FilePath::CompareLessIgnoreCase(a, b);
 }