Not saving whitelist icon paths that reference the parent.

chrome/browser/component_updater/supervised_user_whitelist_installer.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/component_updater/supervised_user_whitelist_installer.h"
 
 #include <stddef.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 60 matching lines @@
   const base::DictionaryValue* icons = nullptr;
   if (!manifest.GetDictionary(kExtensionIcons, &icons))
     return base::FilePath();
 
   base::FilePath path;
   const base::Value* path_value = nullptr;
   if (!icons->Get(kExtensionLargeIcon, &path_value))
     return base::FilePath();
   if (!base::GetValueAsFilePath(*path_value, &path))
     return base::FilePath();
+  // Path components ("..") are not allowed.
+  if (path.ReferencesParent())
+    return base::FilePath();

[Marc Treib, 2016/03/09 14:50:53]

Probably the same should apply below for the raw whitelist path? Maybe worth
making a helper like "GetSafeFilePath(dict, key)"?

[atanasova, 2016/03/10 10:35:28]

Done.

[Bernhard Bauer, 2016/03/15 09:34:52]

(The raw whitelists are read with ReadFileToString, which already refuses to
load a file that references a parent directory, but it's good to fail early
here.)

 
   return install_dir.Append(path);
 }
 
 base::FilePath GetRawWhitelistPath(const base::DictionaryValue& manifest,
                                    const base::FilePath& install_dir) {
   const base::DictionaryValue* whitelist_dict = nullptr;
   if (!manifest.GetDictionary(kWhitelistedContent, &whitelist_dict))
     return base::FilePath();
 
@@ skipping 525 matching lines @@
 
 // static
 void SupervisedUserWhitelistInstaller::TriggerComponentUpdate(
     OnDemandUpdater* updater,
     const std::string& crx_id) {
   const bool result = updater->OnDemandUpdate(crx_id);
   DCHECK(result);
 }
 
 }  // namespace component_updater