[SafeBrowsing] Block dangerous unchecked downloads based on a Finch trial.

chrome/test/ppapi/ppapi_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/bind.h"
+#include "base/command_line.h"
+#include "base/files/file_util.h"
+#include "base/files/scoped_temp_dir.h"
 #include "base/path_service.h"
+#include "base/task_runner.h"
 #include "base/test/test_timeouts.h"
+#include "base/thread_task_runner_handle.h"
 #include "base/win/windows_version.h"
 #include "build/build_config.h"
 #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
 #include "chrome/browser/extensions/extension_browsertest.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_navigator_params.h"
 #include "chrome/browser/ui/extensions/app_launch_params.h"
 #include "chrome/browser/ui/extensions/application_launch.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/chrome_paths.h"
+#include "chrome/common/chrome_switches.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "chrome/test/nacl/nacl_browsertest_util.h"
 #include "chrome/test/ppapi/ppapi_test.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "components/nacl/common/nacl_switches.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/javascript_test_observer.h"
 #include "content/public/test/test_renderer_host.h"
 #include "extensions/common/constants.h"
 #include "extensions/test/extension_test_message_listener.h"
 #include "ppapi/shared_impl/test_utils.h"
+#include "ui/shell_dialogs/select_file_dialog.h"
+#include "ui/shell_dialogs/select_file_dialog_factory.h"
+#include "ui/shell_dialogs/selected_file_info.h"
 
 using content::RenderViewHost;
 
 // This macro finesses macro expansion to do what we want.
 #define STRIP_PREFIXES(test_name) ppapi::StripTestPrefixes(#test_name)
 // Turn the given token into a string. This allows us to use precompiler stuff
 // to turn names into DISABLED_Foo, but still pass a string to RunTest.
 #define STRINGIFY(test_name) #test_name
 #define LIST_TEST(test_name) STRINGIFY(test_name) ","
 
@@ skipping 673 matching lines @@
 }
 IN_PROC_BROWSER_TEST_F(PPAPINaClPNaClNonSfiTest,
                        MAYBE_PNACL_NONSFI(FileRef1)) {
   RUN_FILEREF_SUBTESTS_1;
 }
 IN_PROC_BROWSER_TEST_F(PPAPINaClPNaClNonSfiTest,
                        MAYBE_PNACL_NONSFI(FileRef2)) {
   RUN_FILEREF_SUBTESTS_2;
 }
 
+// FileChooser tests.
+namespace {
+
+class TestSelectFileDialogFactory final : public ui::SelectFileDialogFactory {
+ public:
+  using SelectedFileInfoList = std::vector<ui::SelectedFileInfo>;
+
+  enum Mode {
+    RESPOND_WITH_FILE_LIST,
+    CANCEL,
+    REPLACE_BASENAME,
+    NOT_REACHED,
+  };
+
+  TestSelectFileDialogFactory(Mode mode,
+                              const SelectedFileInfoList& selected_file_info)
+      : selected_file_info_(selected_file_info), mode_(mode) {
+    // Only safe because this class is 'final'
+    ui::SelectFileDialog::SetFactory(this);
+  }
+
+  // SelectFileDialogFactory
+  ui::SelectFileDialog* Create(ui::SelectFileDialog::Listener* listener,
+                               ui::SelectFilePolicy* policy) override {
+    return new SelectFileDialog(listener, policy, selected_file_info_, mode_);
+  }
+
+ private:
+  class SelectFileDialog : public ui::SelectFileDialog {
+   public:
+    SelectFileDialog(Listener* listener,
+                     ui::SelectFilePolicy* policy,
+                     const SelectedFileInfoList& selected_file_info,
+                     Mode mode)
+        : ui::SelectFileDialog(listener, policy),
+          selected_file_info_(selected_file_info),
+          mode_(mode) {}
+
+   protected:
+    // ui::SelectFileDialog
+    void SelectFileImpl(Type type,
+                        const base::string16& title,
+                        const base::FilePath& default_path,
+                        const FileTypeInfo* file_types,
+                        int file_type_index,
+                        const base::FilePath::StringType& default_extension,
+                        gfx::NativeWindow owning_window,
+                        void* params) override {
+      switch (mode_) {
+        case RESPOND_WITH_FILE_LIST:
+          break;
+
+        case CANCEL:
+          EXPECT_EQ(0u, selected_file_info_.size());
+          break;
+
+        case REPLACE_BASENAME:
+          EXPECT_EQ(1u, selected_file_info_.size());
+          for (auto& selected_file : selected_file_info_) {
+            selected_file =
+                ui::SelectedFileInfo(selected_file.file_path.DirName().Append(
+                                         default_path.BaseName()),
+                                     selected_file.local_path.DirName().Append(
+                                         default_path.BaseName()));
+          }
+          break;
+
+        case NOT_REACHED:
+          NOTREACHED();
+          break;
+      }
+
+      base::ThreadTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE,
+          base::Bind(&SelectFileDialog::RespondToFileSelectionRequest, this,
+                     params));
+    }
+    bool HasMultipleFileTypeChoicesImpl() override { return false; }
+
+    // BaseShellDialog
+    bool IsRunning(gfx::NativeWindow owning_window) const override {
+      return false;
+    }
+    void ListenerDestroyed() override {}
+
+   private:
+    void RespondToFileSelectionRequest(void* params) {
+      if (selected_file_info_.size() == 0)
+        listener_->FileSelectionCanceled(params);
+      else if (selected_file_info_.size() == 1)
+        listener_->FileSelectedWithExtraInfo(selected_file_info_.front(), 0,
+                                             params);
+      else
+        listener_->MultiFilesSelectedWithExtraInfo(selected_file_info_, params);
+    }
+
+    SelectedFileInfoList selected_file_info_;
+    Mode mode_;
+  };
+
+  std::vector<ui::SelectedFileInfo> selected_file_info_;
+  Mode mode_;
+};
+
+}  // namespace
+
+IN_PROC_BROWSER_TEST_F(OutOfProcessPPAPITest, FileChooser_Open_Success) {
+  const char kContents[] = "Hello from browser";
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+
+  base::FilePath suggested_filename = temp_dir.path().AppendASCII("foo");
+  ASSERT_EQ(
+      static_cast<int>(sizeof(kContents) - 1),
+      base::WriteFile(suggested_filename, kContents, sizeof(kContents) - 1));
+
+  TestSelectFileDialogFactory::SelectedFileInfoList file_info_list;
+  file_info_list.push_back(
+      ui::SelectedFileInfo(suggested_filename, suggested_filename));
+  TestSelectFileDialogFactory test_dialog_factory(
+      TestSelectFileDialogFactory::RESPOND_WITH_FILE_LIST, file_info_list);
+  RunTest("FileChooser_OpenSimple");
+}
+
+IN_PROC_BROWSER_TEST_F(OutOfProcessPPAPITest, FileChooser_Open_Cancel) {
+  TestSelectFileDialogFactory test_dialog_factory(
+      TestSelectFileDialogFactory::CANCEL,
+      TestSelectFileDialogFactory::SelectedFileInfoList());
+  RunTest("FileChooser_OpenCancel");
+}
+
+IN_PROC_BROWSER_TEST_F(OutOfProcessPPAPITest, FileChooser_SaveAs_Success) {
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+  base::FilePath suggested_filename = temp_dir.path().AppendASCII("foo");
+
+  TestSelectFileDialogFactory::SelectedFileInfoList file_info_list;
+  file_info_list.push_back(
+      ui::SelectedFileInfo(suggested_filename, suggested_filename));
+  TestSelectFileDialogFactory test_dialog_factory(
+      TestSelectFileDialogFactory::RESPOND_WITH_FILE_LIST, file_info_list);
+
+  RunTest("FileChooser_SaveAsSafeDefaultName");
+  ASSERT_TRUE(base::PathExists(suggested_filename));
+}
+
+IN_PROC_BROWSER_TEST_F(OutOfProcessPPAPITest,
+                       FileChooser_SaveAs_SafeDefaultName) {
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+  base::FilePath suggested_filename = temp_dir.path().AppendASCII("foo");
+
+  TestSelectFileDialogFactory::SelectedFileInfoList file_info_list;
+  file_info_list.push_back(
+      ui::SelectedFileInfo(suggested_filename, suggested_filename));
+  TestSelectFileDialogFactory test_dialog_factory(
+      TestSelectFileDialogFactory::REPLACE_BASENAME, file_info_list);
+
+  RunTest("FileChooser_SaveAsSafeDefaultName");
+  base::FilePath actual_filename = temp_dir.path().AppendASCII("innocuous.txt");
+
+  ASSERT_TRUE(base::PathExists(actual_filename));
+  std::string file_contents;
+  ASSERT_TRUE(base::ReadFileToString(actual_filename, &file_contents, 100));
+  EXPECT_EQ("Hello from PPAPI", file_contents);
+}
+
+IN_PROC_BROWSER_TEST_F(OutOfProcessPPAPITest,
+                       FileChooser_SaveAs_UnsafeDefaultName) {
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+  base::FilePath suggested_filename = temp_dir.path().AppendASCII("foo");
+
+  TestSelectFileDialogFactory::SelectedFileInfoList file_info_list;
+  file_info_list.push_back(
+      ui::SelectedFileInfo(suggested_filename, suggested_filename));
+  TestSelectFileDialogFactory test_dialog_factory(
+      TestSelectFileDialogFactory::REPLACE_BASENAME, file_info_list);
+
+  RunTest("FileChooser_SaveAsUnsafeDefaultName");
+  base::FilePath actual_filename = temp_dir.path().AppendASCII("unsafe.txt-");
+
+  ASSERT_TRUE(base::PathExists(actual_filename));
+  std::string file_contents;
+  ASSERT_TRUE(base::ReadFileToString(actual_filename, &file_contents, 100));
+  EXPECT_EQ("Hello from PPAPI", file_contents);
+}
+
+#if defined(FULL_SAFE_BROWSING)
+// These two tests only make sense when SafeBrowsing is enabled. They verify
+// that files written via the FileChooser_Trusted API are properly threaded
+// through Safe Browsing.
+
+IN_PROC_BROWSER_TEST_F(OutOfProcessPPAPITest,
+                       FileChooser_SaveAs_DangerousExecutable_Allowed) {
+  base::CommandLine::ForCurrentProcess()->AppendSwitch(
+      switches::kAllowUncheckedDangerousDownloads);
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+  base::FilePath suggested_filename = temp_dir.path().AppendASCII("foo");
+
+  TestSelectFileDialogFactory::SelectedFileInfoList file_info_list;
+  file_info_list.push_back(
+      ui::SelectedFileInfo(suggested_filename, suggested_filename));
+  TestSelectFileDialogFactory test_dialog_factory(
+      TestSelectFileDialogFactory::REPLACE_BASENAME, file_info_list);
+
+  RunTest("FileChooser_SaveAsDangerousExecutableAllowed");
+  base::FilePath actual_filename = temp_dir.path().AppendASCII("dangerous.exe");
+
+  ASSERT_TRUE(base::PathExists(actual_filename));
+  std::string file_contents;
+  ASSERT_TRUE(base::ReadFileToString(actual_filename, &file_contents, 100));
+  EXPECT_EQ("Hello from PPAPI", file_contents);
+}
+
+IN_PROC_BROWSER_TEST_F(OutOfProcessPPAPITest,
+                       FileChooser_SaveAs_DangerousExecutable_Disallowed) {
+  base::CommandLine::ForCurrentProcess()->AppendSwitch(
+      switches::kDisallowUncheckedDangerousDownloads);
+  TestSelectFileDialogFactory test_dialog_factory(
+      TestSelectFileDialogFactory::NOT_REACHED,
+      TestSelectFileDialogFactory::SelectedFileInfoList());
+  RunTest("FileChooser_SaveAsDangerousExecutableDisallowed");
+}
+
+#endif // FULL_SAFE_BROWSING
+
+// FileSystem tests.
+
 TEST_PPAPI_OUT_OF_PROCESS_VIA_HTTP(FileSystem)
 
 // PPAPINaClTest.FileSystem times out consistently on Windows and Mac.
 // http://crbug.com/130372
 #if defined(OS_MACOSX) || defined(OS_WIN)
 #define MAYBE_FileSystem DISABLED_FileSystem
 #else
 #define MAYBE_FileSystem FileSystem
 #endif
 
@@ skipping 565 matching lines @@
                        MAYBE_PPAPI_NACL(NoSocketPermissions)) {
   RunTests("no_socket_permissions");
 }
 
 IN_PROC_BROWSER_TEST_F(NewlibPackagedAppTest,
                        MAYBE_PPAPI_NACL(SocketPermissions)) {
   RunTests("socket_permissions");
 }
 
 #endif