[Downloads] Prevent dangerous files from being opened automatically.

chrome/browser/download/download_prefs_unittest.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/download/download_prefs.h"
+
+#include "base/files/file_path.h"
+#include "base/prefs/pref_service.h"
+#include "chrome/browser/download/download_extensions.h"
+#include "chrome/common/pref_names.h"
+#include "chrome/test/base/testing_profile.h"
+#include "content/public/test/test_browser_thread_bundle.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+TEST(DownloadPrefsTest, Prerequisites) {
+  // Most of the tests below are based on the assumption that .swf files are not
+  // allowed to open automatically. If this assumption changes, then we need to
+  // update the tests to match.
+  ASSERT_FALSE(download_util::IsAllowedToOpenAutomatically(
+      base::FilePath(FILE_PATH_LITERAL("a.swf"))));
+}
+
+TEST(DownloadPrefsTest, NoAutoOpenForExecutables) {

[palmer, 2015/06/08 19:05:07]

Do we need to do anything special about alternative data streams on systems
using NTFS? (Perhaps not, because a web download can't cause any ADS to be
created? But could Chrome somehow get invoked to run a file that does have an
ADS?)

[asanka, 2015/06/09 00:38:10]

Hm. We are making the following assumptions:

 1. Chrome can only auto-open file it downloaded itself.

 2. The files Chrome downloaded are have names corresponding to what
DownloadItem::GetTargetFilePath() returns.

 3. Said files consist of a primary data stream corresponding to the resource
transferred from DownloadItem::GetURL().

 4. Opening behavior of a downloaded file is predicted by the filename as
mentioned in #2, and not on the contents of the primary data stream nor
alternate streams.

If these assumptions are not correct, then we have a security issue. Of course,
they can be violated by some nefarious program running on the users' machine
with user level privileges, but that's outside our threat model.

+  const base::FilePath kDangerousFilePath(FILE_PATH_LITERAL("/b/very-bad.swf"));
+  const base::FilePath kFileWithNoExtension(FILE_PATH_LITERAL("abcd"));
+
+  content::TestBrowserThreadBundle threads_are_required_for_testing_profile;
+  TestingProfile profile;
+  DownloadPrefs prefs(&profile);
+
+  EXPECT_FALSE(prefs.EnableAutoOpenBasedOnExtension(kDangerousFilePath));
+  EXPECT_FALSE(prefs.IsAutoOpenEnabledBasedOnExtension(kDangerousFilePath));
+}
+
+TEST(DownloadPrefsTest, NoAutoOpenForFilesWithNoExtension) {
+  const base::FilePath kFileWithNoExtension(FILE_PATH_LITERAL("abcd"));
+
+  content::TestBrowserThreadBundle threads_are_required_for_testing_profile;
+  TestingProfile profile;
+  DownloadPrefs prefs(&profile);
+
+  EXPECT_FALSE(prefs.EnableAutoOpenBasedOnExtension(kFileWithNoExtension));
+  EXPECT_FALSE(prefs.IsAutoOpenEnabledBasedOnExtension(kFileWithNoExtension));
+}
+
+TEST(DownloadPrefsTest, AutoOpenForSafeFiles) {
+  const base::FilePath kSafeFilePath(
+      FILE_PATH_LITERAL("/good/nothing-wrong.txt"));
+  const base::FilePath kAnotherSafeFilePath(
+      FILE_PATH_LITERAL("/ok/not-bad.txt"));
+
+  content::TestBrowserThreadBundle threads_are_required_for_testing_profile;
+  TestingProfile profile;
+  DownloadPrefs prefs(&profile);
+
+  EXPECT_TRUE(prefs.EnableAutoOpenBasedOnExtension(kSafeFilePath));
+  EXPECT_TRUE(prefs.IsAutoOpenEnabledBasedOnExtension(kSafeFilePath));
+  EXPECT_TRUE(prefs.IsAutoOpenEnabledBasedOnExtension(kAnotherSafeFilePath));
+}
+
+TEST(DownloadPrefsTest, AutoOpenPrefSkipsDangerousFileTypesInPrefs) {
+  const base::FilePath kDangerousFilePath(FILE_PATH_LITERAL("/b/very-bad.swf"));
+  const base::FilePath kSafeFilePath(
+      FILE_PATH_LITERAL("/good/nothing-wrong.txt"));
+
+  content::TestBrowserThreadBundle threads_are_required_for_testing_profile;
+  TestingProfile profile;
+  // This sets .swf files and .txt files as auto-open file types.
+  profile.GetPrefs()->SetString(prefs::kDownloadExtensionsToOpen, "swf:txt");
+  DownloadPrefs prefs(&profile);
+
+  EXPECT_FALSE(prefs.IsAutoOpenEnabledBasedOnExtension(kDangerousFilePath));
+  EXPECT_TRUE(prefs.IsAutoOpenEnabledBasedOnExtension(kSafeFilePath));
+}
+
+TEST(DownloadPrefsTest, PrefsInitializationSkipsInvalidFileTypes) {
+  content::TestBrowserThreadBundle threads_are_required_for_testing_profile;
+  TestingProfile profile;
+  profile.GetPrefs()->SetString(prefs::kDownloadExtensionsToOpen,
+                                "swf:txt::.foo:baz");
+  DownloadPrefs prefs(&profile);
+  prefs.DisableAutoOpenBasedOnExtension(
+      base::FilePath(FILE_PATH_LITERAL("x.baz")));
+
+  EXPECT_FALSE(prefs.IsAutoOpenEnabledBasedOnExtension(
+      base::FilePath(FILE_PATH_LITERAL("x.swf"))));
+  EXPECT_TRUE(prefs.IsAutoOpenEnabledBasedOnExtension(
+      base::FilePath(FILE_PATH_LITERAL("x.txt"))));
+  EXPECT_FALSE(prefs.IsAutoOpenEnabledBasedOnExtension(
+      base::FilePath(FILE_PATH_LITERAL("x.foo"))));
+
+  // .swf is skipped because it's not an allowed auto-open file type.
+  // The empty entry and .foo are skipped because they are malformed.
+  // "baz" is removed by the DisableAutoOpenBasedOnExtension() call.
+  // The only entry that should be remaining is 'txt'.
+  EXPECT_STREQ(
+      "txt",
+      profile.GetPrefs()->GetString(prefs::kDownloadExtensionsToOpen).c_str());
+}
+
+TEST(DownloadPrefsTest, AutoOpenCheckIsCaseInsensitive) {
+  content::TestBrowserThreadBundle threads_are_required_for_testing_profile;
+  TestingProfile profile;
+  profile.GetPrefs()->SetString(prefs::kDownloadExtensionsToOpen,
+                                "txt:Foo:BAR");
+  DownloadPrefs prefs(&profile);
+
+  EXPECT_TRUE(prefs.IsAutoOpenEnabledBasedOnExtension(
+      base::FilePath(FILE_PATH_LITERAL("x.txt"))));
+  EXPECT_TRUE(prefs.IsAutoOpenEnabledBasedOnExtension(
+      base::FilePath(FILE_PATH_LITERAL("x.TXT"))));
+  EXPECT_TRUE(prefs.IsAutoOpenEnabledBasedOnExtension(
+      base::FilePath(FILE_PATH_LITERAL("x.foo"))));
+  EXPECT_TRUE(prefs.IsAutoOpenEnabledBasedOnExtension(
+      base::FilePath(FILE_PATH_LITERAL("x.Bar"))));
+}