| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/win/src/named_pipe_dispatcher.h" | 5 #include "sandbox/win/src/named_pipe_dispatcher.h" |
| 6 | 6 |
| 7 #include "base/basictypes.h" | 7 #include "base/basictypes.h" |
| 8 #include "base/strings/string_split.h" | 8 #include "base/strings/string_split.h" |
| 9 | 9 |
| 10 #include "sandbox/win/src/crosscall_client.h" | 10 #include "sandbox/win/src/crosscall_client.h" |
| 11 #include "sandbox/win/src/interception.h" | 11 #include "sandbox/win/src/interception.h" |
| 12 #include "sandbox/win/src/interceptors.h" | 12 #include "sandbox/win/src/interceptors.h" |
| 13 #include "sandbox/win/src/ipc_tags.h" | 13 #include "sandbox/win/src/ipc_tags.h" |
| 14 #include "sandbox/win/src/named_pipe_interception.h" | 14 #include "sandbox/win/src/named_pipe_interception.h" |
| 15 #include "sandbox/win/src/named_pipe_policy.h" | 15 #include "sandbox/win/src/named_pipe_policy.h" |
| 16 #include "sandbox/win/src/policy_broker.h" | 16 #include "sandbox/win/src/policy_broker.h" |
| 17 #include "sandbox/win/src/policy_params.h" | 17 #include "sandbox/win/src/policy_params.h" |
| 18 #include "sandbox/win/src/sandbox.h" | 18 #include "sandbox/win/src/sandbox.h" |
| 19 | 19 |
| 20 | 20 |
| 21 namespace sandbox { | 21 namespace sandbox { |
| 22 | 22 |
| 23 NamedPipeDispatcher::NamedPipeDispatcher(PolicyBase* policy_base) | 23 NamedPipeDispatcher::NamedPipeDispatcher(TargetPolicy* policy) |
| 24 : policy_base_(policy_base) { | 24 : policy_(policy) { |
| 25 static const IPCCall create_params = { | 25 static const IPCCall create_params = { |
| 26 {IPC_CREATENAMEDPIPEW_TAG, | 26 {IPC_CREATENAMEDPIPEW_TAG, |
| 27 {WCHAR_TYPE, | 27 {WCHAR_TYPE, |
| 28 UINT32_TYPE, | 28 UINT32_TYPE, |
| 29 UINT32_TYPE, | 29 UINT32_TYPE, |
| 30 UINT32_TYPE, | 30 UINT32_TYPE, |
| 31 UINT32_TYPE, | 31 UINT32_TYPE, |
| 32 UINT32_TYPE, | 32 UINT32_TYPE, |
| 33 UINT32_TYPE}}, | 33 UINT32_TYPE}}, |
| 34 reinterpret_cast<CallbackGeneric>(&NamedPipeDispatcher::CreateNamedPipe)}; | 34 reinterpret_cast<CallbackGeneric>(&NamedPipeDispatcher::CreateNamedPipe)}; |
| (...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 66 base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL)) { | 66 base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL)) { |
| 67 if (inner == dotdot) | 67 if (inner == dotdot) |
| 68 return true; | 68 return true; |
| 69 } | 69 } |
| 70 } | 70 } |
| 71 | 71 |
| 72 const wchar_t* pipe_name = name->c_str(); | 72 const wchar_t* pipe_name = name->c_str(); |
| 73 CountedParameterSet<NameBased> params; | 73 CountedParameterSet<NameBased> params; |
| 74 params[NameBased::NAME] = ParamPickerMake(pipe_name); | 74 params[NameBased::NAME] = ParamPickerMake(pipe_name); |
| 75 | 75 |
| 76 EvalResult eval = policy_base_->EvalPolicy(IPC_CREATENAMEDPIPEW_TAG, | 76 EvalResult eval = |
| 77 params.GetBase()); | 77 policy_->EvalPolicy(IPC_CREATENAMEDPIPEW_TAG, params.GetBase()); |
| 78 | 78 |
| 79 // "For file I/O, the "\\?\" prefix to a path string tells the Windows APIs to | 79 // "For file I/O, the "\\?\" prefix to a path string tells the Windows APIs to |
| 80 // disable all string parsing and to send the string that follows it straight | 80 // disable all string parsing and to send the string that follows it straight |
| 81 // to the file system." | 81 // to the file system." |
| 82 // http://msdn.microsoft.com/en-us/library/aa365247(VS.85).aspx | 82 // http://msdn.microsoft.com/en-us/library/aa365247(VS.85).aspx |
| 83 // This ensures even if there is a path traversal in the pipe name, and it is | 83 // This ensures even if there is a path traversal in the pipe name, and it is |
| 84 // able to get past the checks above, it will still not be allowed to escape | 84 // able to get past the checks above, it will still not be allowed to escape |
| 85 // our whitelisted namespace. | 85 // our whitelisted namespace. |
| 86 if (name->compare(0, 4, L"\\\\.\\") == 0) | 86 if (name->compare(0, 4, L"\\\\.\\") == 0) |
| 87 name->replace(0, 4, L"\\\\\?\\"); | 87 name->replace(0, 4, L"\\\\\?\\"); |
| 88 | 88 |
| 89 HANDLE pipe; | 89 HANDLE pipe; |
| 90 DWORD ret = NamedPipePolicy::CreateNamedPipeAction(eval, *ipc->client_info, | 90 DWORD ret = NamedPipePolicy::CreateNamedPipeAction(eval, *ipc->client_info, |
| 91 *name, open_mode, | 91 *name, open_mode, |
| 92 pipe_mode, max_instances, | 92 pipe_mode, max_instances, |
| 93 out_buffer_size, | 93 out_buffer_size, |
| 94 in_buffer_size, | 94 in_buffer_size, |
| 95 default_timeout, &pipe); | 95 default_timeout, &pipe); |
| 96 | 96 |
| 97 ipc->return_info.win32_result = ret; | 97 ipc->return_info.win32_result = ret; |
| 98 ipc->return_info.handle = pipe; | 98 ipc->return_info.handle = pipe; |
| 99 return true; | 99 return true; |
| 100 } | 100 } |
| 101 | 101 |
| 102 } // namespace sandbox | 102 } // namespace sandbox |
| OLD | NEW |