Not saving whitelist icon paths that reference the parent.

chrome/browser/component_updater/supervised_user_whitelist_installer.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/component_updater/supervised_user_whitelist_installer.h"
 
 #include <stddef.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 48 matching lines @@
 const char kExtensionIcons[] = "icons";
 const char kExtensionLargeIcon[] = "128";
 
 base::string16 GetWhitelistTitle(const base::DictionaryValue& manifest) {
   base::string16 title;
   if (!manifest.GetString(kExtensionShortName, &title))
     manifest.GetString(kExtensionName, &title);
   return title;
 }
 
+base::FilePath GetSafeFilePath(const base::DictionaryValue& dictionary,
+                               const std::string& key,
+                               const base::FilePath& install_dir) {
+  const base::Value* path_value = nullptr;
+  if (!dictionary.Get(key, &path_value))
+    return base::FilePath();
+  base::FilePath path;
+  if (!base::GetValueAsFilePath(*path_value, &path))
+    return base::FilePath();
+  // Path components ("..") are not allowed.
+  if (path.ReferencesParent())
+    return base::FilePath();
+
+  return install_dir.Append(path);
+}
+
 base::FilePath GetLargeIconPath(const base::DictionaryValue& manifest,
                                 const base::FilePath& install_dir) {
   const base::DictionaryValue* icons = nullptr;
   if (!manifest.GetDictionary(kExtensionIcons, &icons))
     return base::FilePath();
 
-  base::FilePath path;
-  const base::Value* path_value = nullptr;
-  if (!icons->Get(kExtensionLargeIcon, &path_value))
-    return base::FilePath();
-  if (!base::GetValueAsFilePath(*path_value, &path))
-    return base::FilePath();
-
-  return install_dir.Append(path);
+  return GetSafeFilePath(*icons, kExtensionLargeIcon, install_dir);
 }
 
 base::FilePath GetRawWhitelistPath(const base::DictionaryValue& manifest,
                                    const base::FilePath& install_dir) {
   const base::DictionaryValue* whitelist_dict = nullptr;
   if (!manifest.GetDictionary(kWhitelistedContent, &whitelist_dict))
     return base::FilePath();
 
-  base::FilePath whitelist_file;
-  const base::Value* whitelist_file_value = nullptr;
-  if (!whitelist_dict->Get(kSites, &whitelist_file_value))
-    return base::FilePath();
-  if (!base::GetValueAsFilePath(*whitelist_file_value, &whitelist_file))
-    return base::FilePath();
-
-  return install_dir.Append(whitelist_file);
+  return GetSafeFilePath(*whitelist_dict, kSites, install_dir);
 }
 
 base::FilePath GetSanitizedWhitelistPath(const std::string& crx_id) {
   base::FilePath base_dir;
   PathService::Get(chrome::DIR_SUPERVISED_USER_INSTALLED_WHITELISTS, &base_dir);
   return base_dir.empty()
              ? base::FilePath()
              : base_dir.AppendASCII(crx_id + kSanitizedWhitelistExtension);
 }
 
@@ skipping 507 matching lines @@
 
 // static
 void SupervisedUserWhitelistInstaller::TriggerComponentUpdate(
     OnDemandUpdater* updater,
     const std::string& crx_id) {
   const bool result = updater->OnDemandUpdate(crx_id);
   DCHECK(result);
 }
 
 }  // namespace component_updater