Merge 198744 "Fix security errors when accessing files and volum..."

chrome/browser/chromeos/extensions/file_manager/file_handler_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/extensions/file_manager/file_handler_util.h"
 
 #include "base/bind.h"
 #include "base/file_util.h"
 #include "base/i18n/case_conversion.h"
 #include "base/json/json_writer.h"
@@ skipping 799 matching lines @@
 }
 
 ExtensionTaskExecutor::~ExtensionTaskExecutor() {}
 
 bool ExtensionTaskExecutor::ExecuteAndNotify(
     const std::vector<FileSystemURL>& file_urls,
     const FileTaskFinishedCallback& done) {
   if (!FileBrowserHasAccessPermissionForFiles(file_urls))
     return false;
 
-  scoped_refptr<const Extension> handler = GetExtension();
-  if (!handler.get())
+  // Find the target extension.
+  scoped_refptr<const Extension> extension = GetExtension();
+  if (!extension.get())
     return false;
 
-  int handler_pid = ExtractProcessFromExtensionId(profile(), handler->id());
-  if (handler_pid <= 0) {
-    if (!extensions::BackgroundInfo::HasLazyBackgroundPage(handler))
+  // Forbid calling undeclared handlers.
+  if (!FindFileBrowserHandler(extension, action_id_))
+    return false;
+
+  int extension_pid = ExtractProcessFromExtensionId(profile(), extension->id());
+  if (extension_pid <= 0) {
+    if (!extensions::BackgroundInfo::HasLazyBackgroundPage(extension))
       return false;
   }
 
   done_ = done;
 
   // Get file system context for the extension to which onExecute event will be
   // send. The file access permissions will be granted to the extension in the
   // file system context for the files in |file_urls|.
   GURL site = extensions::ExtensionSystem::Get(profile())->extension_service()->
-      GetSiteForExtensionId(handler->id());
+      GetSiteForExtensionId(extension->id());
   scoped_refptr<fileapi::FileSystemContext> file_system_context_handler =
       BrowserContext::GetStoragePartitionForSite(profile(), site)->
       GetFileSystemContext();
 
   BrowserThread::PostTask(
       BrowserThread::FILE, FROM_HERE,
       base::Bind(
           &ExtensionTaskExecutor::RequestFileEntryOnFileThread,
           this,
           file_system_context_handler,
-          Extension::GetBaseURLFromExtensionId(handler->id()),
-          handler,
-          handler_pid,
+          Extension::GetBaseURLFromExtensionId(extension->id()),
+          extension,
+          extension_pid,
           file_urls));
   return true;
 }
 
 void ExtensionTaskExecutor::RequestFileEntryOnFileThread(
     scoped_refptr<fileapi::FileSystemContext> file_system_context_handler,
     const GURL& handler_base_url,
     const scoped_refptr<const Extension>& handler,
     int handler_pid,
     const std::vector<FileSystemURL>& file_urls) {
@@ skipping 146 matching lines @@
     extensions::LaunchPlatformAppWithFileHandler(profile(), GetExtension(),
         action_id_, file_urls[i].path());
   }
 
   if (!done.is_null())
     done.Run(true);
   return true;
 }
 
 } // namespace file_handler_util