OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/win/src/named_pipe_dispatcher.h" | 5 #include "sandbox/win/src/named_pipe_dispatcher.h" |
6 | 6 |
7 #include "base/basictypes.h" | 7 #include "base/basictypes.h" |
8 #include "base/strings/string_split.h" | 8 #include "base/strings/string_split.h" |
9 | 9 |
10 #include "sandbox/win/src/crosscall_client.h" | 10 #include "sandbox/win/src/crosscall_client.h" |
11 #include "sandbox/win/src/interception.h" | 11 #include "sandbox/win/src/interception.h" |
12 #include "sandbox/win/src/interceptors.h" | 12 #include "sandbox/win/src/interceptors.h" |
13 #include "sandbox/win/src/ipc_tags.h" | 13 #include "sandbox/win/src/ipc_tags.h" |
14 #include "sandbox/win/src/named_pipe_interception.h" | 14 #include "sandbox/win/src/named_pipe_interception.h" |
15 #include "sandbox/win/src/named_pipe_policy.h" | 15 #include "sandbox/win/src/named_pipe_policy.h" |
16 #include "sandbox/win/src/policy_broker.h" | 16 #include "sandbox/win/src/policy_broker.h" |
17 #include "sandbox/win/src/policy_params.h" | 17 #include "sandbox/win/src/policy_params.h" |
18 #include "sandbox/win/src/sandbox.h" | 18 #include "sandbox/win/src/sandbox.h" |
19 | 19 |
20 | 20 |
21 namespace sandbox { | 21 namespace sandbox { |
22 | 22 |
23 NamedPipeDispatcher::NamedPipeDispatcher(PolicyBase* policy_base) | 23 NamedPipeDispatcher::NamedPipeDispatcher(TargetPolicy* policy) |
24 : policy_base_(policy_base) { | 24 : policy_(policy) { |
25 static const IPCCall create_params = { | 25 static const IPCCall create_params = { |
26 {IPC_CREATENAMEDPIPEW_TAG, | 26 {IPC_CREATENAMEDPIPEW_TAG, |
27 {WCHAR_TYPE, | 27 {WCHAR_TYPE, |
28 UINT32_TYPE, | 28 UINT32_TYPE, |
29 UINT32_TYPE, | 29 UINT32_TYPE, |
30 UINT32_TYPE, | 30 UINT32_TYPE, |
31 UINT32_TYPE, | 31 UINT32_TYPE, |
32 UINT32_TYPE, | 32 UINT32_TYPE, |
33 UINT32_TYPE}}, | 33 UINT32_TYPE}}, |
34 reinterpret_cast<CallbackGeneric>(&NamedPipeDispatcher::CreateNamedPipe)}; | 34 reinterpret_cast<CallbackGeneric>(&NamedPipeDispatcher::CreateNamedPipe)}; |
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
66 base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL)) { | 66 base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL)) { |
67 if (inner == dotdot) | 67 if (inner == dotdot) |
68 return true; | 68 return true; |
69 } | 69 } |
70 } | 70 } |
71 | 71 |
72 const wchar_t* pipe_name = name->c_str(); | 72 const wchar_t* pipe_name = name->c_str(); |
73 CountedParameterSet<NameBased> params; | 73 CountedParameterSet<NameBased> params; |
74 params[NameBased::NAME] = ParamPickerMake(pipe_name); | 74 params[NameBased::NAME] = ParamPickerMake(pipe_name); |
75 | 75 |
76 EvalResult eval = policy_base_->EvalPolicy(IPC_CREATENAMEDPIPEW_TAG, | 76 EvalResult eval = |
77 params.GetBase()); | 77 policy_->EvalPolicy(IPC_CREATENAMEDPIPEW_TAG, params.GetBase()); |
78 | 78 |
79 // "For file I/O, the "\\?\" prefix to a path string tells the Windows APIs to | 79 // "For file I/O, the "\\?\" prefix to a path string tells the Windows APIs to |
80 // disable all string parsing and to send the string that follows it straight | 80 // disable all string parsing and to send the string that follows it straight |
81 // to the file system." | 81 // to the file system." |
82 // http://msdn.microsoft.com/en-us/library/aa365247(VS.85).aspx | 82 // http://msdn.microsoft.com/en-us/library/aa365247(VS.85).aspx |
83 // This ensures even if there is a path traversal in the pipe name, and it is | 83 // This ensures even if there is a path traversal in the pipe name, and it is |
84 // able to get past the checks above, it will still not be allowed to escape | 84 // able to get past the checks above, it will still not be allowed to escape |
85 // our whitelisted namespace. | 85 // our whitelisted namespace. |
86 if (name->compare(0, 4, L"\\\\.\\") == 0) | 86 if (name->compare(0, 4, L"\\\\.\\") == 0) |
87 name->replace(0, 4, L"\\\\\?\\"); | 87 name->replace(0, 4, L"\\\\\?\\"); |
88 | 88 |
89 HANDLE pipe; | 89 HANDLE pipe; |
90 DWORD ret = NamedPipePolicy::CreateNamedPipeAction(eval, *ipc->client_info, | 90 DWORD ret = NamedPipePolicy::CreateNamedPipeAction(eval, *ipc->client_info, |
91 *name, open_mode, | 91 *name, open_mode, |
92 pipe_mode, max_instances, | 92 pipe_mode, max_instances, |
93 out_buffer_size, | 93 out_buffer_size, |
94 in_buffer_size, | 94 in_buffer_size, |
95 default_timeout, &pipe); | 95 default_timeout, &pipe); |
96 | 96 |
97 ipc->return_info.win32_result = ret; | 97 ipc->return_info.win32_result = ret; |
98 ipc->return_info.handle = pipe; | 98 ipc->return_info.handle = pipe; |
99 return true; | 99 return true; |
100 } | 100 } |
101 | 101 |
102 } // namespace sandbox | 102 } // namespace sandbox |
OLD | NEW |