New FileSystemURL cracking

content/browser/fileapi/fileapi_message_filter.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/fileapi/fileapi_message_filter.h"
 
 #include <string>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 97 matching lines @@
 
   // Close all files that are previously OpenFile()'ed in this process.
   if (!open_filesystem_urls_.empty()) {
     DLOG(INFO)
         << "File API: Renderer process shut down before NotifyCloseFile"
         << " for " << open_filesystem_urls_.size() << " files opened in PPAPI";
   }
   for (std::multiset<GURL>::const_iterator iter =
        open_filesystem_urls_.begin();
        iter != open_filesystem_urls_.end(); ++iter) {
-    FileSystemURL url(*iter);
+    FileSystemURL url(context_->CrackURL(*iter));
     FileSystemOperation* operation = context_->CreateFileSystemOperation(
         url, NULL);
     if (operation)
       operation->NotifyCloseFile(url);
   }
 }
 
 void FileAPIMessageFilter::OverrideThreadForMessage(
     const IPC::Message& message,
     BrowserThread::ID* thread) {
@@ skipping 71 matching lines @@
     fileapi::FileSystemType type) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   context_->DeleteFileSystem(origin_url, type, base::Bind(
       &FileAPIMessageFilter::DidDeleteFileSystem, this, request_id));
 }
 
 void FileAPIMessageFilter::OnMove(
     int request_id, const GURL& src_path, const GURL& dest_path) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   base::PlatformFileError error;
-  FileSystemURL src_url(src_path);
-  FileSystemURL dest_url(dest_path);
+  FileSystemURL src_url(context_->CrackURL(src_path));
+  FileSystemURL dest_url(context_->CrackURL(dest_path));
   const int src_permissions =
       fileapi::kReadFilePermissions | fileapi::kWriteFilePermissions;
   if (!HasPermissionsForFile(src_url, src_permissions, &error) ||
       !HasPermissionsForFile(
           dest_url, fileapi::kCreateFilePermissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
     return;
   }
 
   FileSystemOperation* operation = GetNewOperation(dest_url, request_id);
   if (!operation)
     return;
   operation->Move(
       src_url, dest_url,
       base::Bind(&FileAPIMessageFilter::DidFinish, this, request_id));
 }
 
 void FileAPIMessageFilter::OnCopy(
     int request_id, const GURL& src_path, const GURL& dest_path) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   base::PlatformFileError error;
-  FileSystemURL src_url(src_path);
-  FileSystemURL dest_url(dest_path);
+  FileSystemURL src_url(context_->CrackURL(src_path));
+  FileSystemURL dest_url(context_->CrackURL(dest_path));
   if (!HasPermissionsForFile(src_url, fileapi::kReadFilePermissions, &error) ||
       !HasPermissionsForFile(
           dest_url, fileapi::kCreateFilePermissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
     return;
   }
 
   FileSystemOperation* operation = GetNewOperation(dest_url, request_id);
   if (!operation)
     return;
   operation->Copy(
       src_url, dest_url,
       base::Bind(&FileAPIMessageFilter::DidFinish, this, request_id));
 }
 
 void FileAPIMessageFilter::OnRemove(
     int request_id, const GURL& path, bool recursive) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   base::PlatformFileError error;
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   if (!HasPermissionsForFile(url, fileapi::kWriteFilePermissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
     return;
   }
 
   FileSystemOperation* operation = GetNewOperation(url, request_id);
   if (!operation)
     return;
   operation->Remove(
       url, recursive,
       base::Bind(&FileAPIMessageFilter::DidFinish, this, request_id));
 }
 
 void FileAPIMessageFilter::OnReadMetadata(
     int request_id, const GURL& path) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   base::PlatformFileError error;
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   if (!HasPermissionsForFile(url, fileapi::kReadFilePermissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
     return;
   }
 
   FileSystemOperation* operation = GetNewOperation(url, request_id);
   if (!operation)
     return;
   operation->GetMetadata(
       url,
       base::Bind(&FileAPIMessageFilter::DidGetMetadata, this, request_id));
 }
 
 void FileAPIMessageFilter::OnCreate(
     int request_id, const GURL& path, bool exclusive,
     bool is_directory, bool recursive) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   base::PlatformFileError error;
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   if (!HasPermissionsForFile(url, fileapi::kCreateFilePermissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
     return;
   }
 
   FileSystemOperation* operation = GetNewOperation(url, request_id);
   if (!operation)
     return;
   if (is_directory) {
     operation->CreateDirectory(
         url, exclusive, recursive,
         base::Bind(&FileAPIMessageFilter::DidFinish, this, request_id));
   } else {
     operation->CreateFile(
         url, exclusive,
         base::Bind(&FileAPIMessageFilter::DidFinish, this, request_id));
   }
 }
 
 void FileAPIMessageFilter::OnExists(
     int request_id, const GURL& path, bool is_directory) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   base::PlatformFileError error;
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   if (!HasPermissionsForFile(url, fileapi::kReadFilePermissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
     return;
   }
 
   FileSystemOperation* operation = GetNewOperation(url, request_id);
   if (!operation)
     return;
   if (is_directory) {
     operation->DirectoryExists(
         url,
         base::Bind(&FileAPIMessageFilter::DidFinish, this, request_id));
   } else {
     operation->FileExists(
         url,
         base::Bind(&FileAPIMessageFilter::DidFinish, this, request_id));
   }
 }
 
 void FileAPIMessageFilter::OnReadDirectory(
     int request_id, const GURL& path) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   base::PlatformFileError error;
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   if (!HasPermissionsForFile(url, fileapi::kReadFilePermissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
     return;
   }
 
   FileSystemOperation* operation = GetNewOperation(url, request_id);
   if (!operation)
     return;
   operation->ReadDirectory(
       url, base::Bind(&FileAPIMessageFilter::DidReadDirectory,
                        this, request_id));
 }
 
 void FileAPIMessageFilter::OnWrite(
     int request_id,
     const GURL& path,
     const GURL& blob_url,
     int64 offset) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   if (!request_context_) {
     // We can't write w/o a request context, trying to do so will crash.
     NOTREACHED();
     return;
   }
 
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   base::PlatformFileError error;
   if (!HasPermissionsForFile(url, fileapi::kWriteFilePermissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
     return;
   }
 
   FileSystemOperation* operation = GetNewOperation(url, request_id);
   if (!operation)
     return;
   operation->Write(
       request_context_, url, blob_url, offset,
       base::Bind(&FileAPIMessageFilter::DidWrite, this, request_id));
 }
 
 void FileAPIMessageFilter::OnTruncate(
     int request_id,
     const GURL& path,
     int64 length) {
   base::PlatformFileError error;
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   if (!HasPermissionsForFile(url, fileapi::kWriteFilePermissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
     return;
   }
 
   FileSystemOperation* operation = GetNewOperation(url, request_id);
   if (!operation)
     return;
   operation->Truncate(
       url, length,
       base::Bind(&FileAPIMessageFilter::DidFinish, this, request_id));
 }
 
 void FileAPIMessageFilter::OnTouchFile(
     int request_id,
     const GURL& path,
     const base::Time& last_access_time,
     const base::Time& last_modified_time) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   base::PlatformFileError error;
   if (!HasPermissionsForFile(url, fileapi::kCreateFilePermissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
     return;
   }
 
   FileSystemOperation* operation = GetNewOperation(url, request_id);
   if (!operation)
     return;
   operation->TouchFile(
@@ skipping 17 matching lines @@
         request_id, base::PLATFORM_FILE_ERROR_INVALID_OPERATION));
   }
 }
 
 void FileAPIMessageFilter::OnOpenFile(
     int request_id, const GURL& path, int file_flags) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   base::PlatformFileError error;
   const int open_permissions = base::PLATFORM_FILE_OPEN |
                                (file_flags & fileapi::kOpenFilePermissions);
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   if (!HasPermissionsForFile(url, open_permissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
     return;
   }
 
   FileSystemOperation* operation = GetNewOperation(url, request_id);
   if (!operation)
     return;
   operation->OpenFile(
       url, file_flags, peer_handle(),
       base::Bind(&FileAPIMessageFilter::DidOpenFile, this, request_id, path));
 }
 
 void FileAPIMessageFilter::OnNotifyCloseFile(const GURL& path) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 
   // Remove |path| from the set of opened urls. It must only be called for a URL
   // that is successfully opened and enrolled in DidOpenFile.
   std::multiset<GURL>::iterator iter = open_filesystem_urls_.find(path);
   DCHECK(iter != open_filesystem_urls_.end());
   open_filesystem_urls_.erase(iter);
 
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
 
   // Do not use GetNewOperation() here, because NotifyCloseFile is a one-way
   // operation that does not have request_id by which we respond back.
   FileSystemOperation* operation = context_->CreateFileSystemOperation(
       url, NULL);
   if (operation)
     operation->NotifyCloseFile(url);
 }
 
 void FileAPIMessageFilter::OnWillUpdate(const GURL& path) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   if (!url.is_valid())
     return;
   const UpdateObserverList* observers =
       context_->GetUpdateObservers(url.type());
   if (!observers)
     return;
   observers->Notify(&FileUpdateObserver::OnStartUpdate, MakeTuple(url));
 }
 
 void FileAPIMessageFilter::OnDidUpdate(const GURL& path, int64 delta) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   if (!url.is_valid())
     return;
   const UpdateObserverList* observers =
       context_->GetUpdateObservers(url.type());
   if (!observers)
     return;
   observers->Notify(&FileUpdateObserver::OnUpdate, MakeTuple(url, delta));
   observers->Notify(&FileUpdateObserver::OnEndUpdate, MakeTuple(url));
 }
 
 void FileAPIMessageFilter::OnSyncGetPlatformPath(
     const GURL& path, FilePath* platform_path) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
   DCHECK(platform_path);
   *platform_path = FilePath();
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   if (!url.is_valid())
     return;
 
   // Make sure if this file is ok to be read (in the current architecture
   // which means roughly same as the renderer is allowed to get the platform
   // path to the file).
   base::PlatformFileError error;
   if (!HasPermissionsForFile(url, fileapi::kReadFilePermissions, &error))
     return;
 
@@ skipping 17 matching lines @@
   if (!ChildProcessSecurityPolicyImpl::GetInstance()->CanReadFile(
           process_id_, *platform_path)) {
     ChildProcessSecurityPolicyImpl::GetInstance()->GrantReadFile(
         process_id_, *platform_path);
   }
 }
 
 void FileAPIMessageFilter::OnCreateSnapshotFile(
     int request_id, const GURL& blob_url, const GURL& path) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  FileSystemURL url(path);
+  FileSystemURL url(context_->CrackURL(path));
   base::Callback<void(const FilePath&)> register_file_callback =
       base::Bind(&FileAPIMessageFilter::RegisterFileAsBlob,
                  this, blob_url, url);
 
   // Make sure if this file can be read by the renderer as this is
   // called when the renderer is about to create a new File object
   // (for reading the file).
   base::PlatformFileError error;
   if (!HasPermissionsForFile(url, fileapi::kReadFilePermissions, &error)) {
     Send(new FileSystemMsg_DidFail(request_id, error));
@@ skipping 310 matching lines @@
     Send(new FileSystemMsg_DidFail(request_id, error_code));
     return NULL;
   }
 
   DCHECK(operation);
   operations_.AddWithID(operation, request_id);
   return operation;
 }
 
 }  // namespace content