Not saving whitelist icon paths that reference the parent.

chrome/browser/component_updater/supervised_user_whitelist_installer.cc

Index: chrome/browser/component_updater/supervised_user_whitelist_installer.cc
diff --git a/chrome/browser/component_updater/supervised_user_whitelist_installer.cc b/chrome/browser/component_updater/supervised_user_whitelist_installer.cc
index 7989e954670c5299bc7360235a9be67af803ac1e..0edda899e96912f5f2256cdf85d632ed3dcf4a24 100644
--- a/chrome/browser/component_updater/supervised_user_whitelist_installer.cc
+++ b/chrome/browser/component_updater/supervised_user_whitelist_installer.cc
@@ -66,36 +66,38 @@ base::string16 GetWhitelistTitle(const base::DictionaryValue& manifest) {
   return title;
 }
 
-base::FilePath GetLargeIconPath(const base::DictionaryValue& manifest,
-                                const base::FilePath& install_dir) {
-  const base::DictionaryValue* icons = nullptr;
-  if (!manifest.GetDictionary(kExtensionIcons, &icons))
-    return base::FilePath();
-
+base::FilePath GetSafeFilePath(const base::DictionaryValue& dictionary,
+                               const std::string& key,
+                               const base::FilePath& install_dir) {
   base::FilePath path;

[Bernhard Bauer, 2016/03/15 09:34:52]

Move this to where it's used.

[atanasova, 2016/03/15 11:22:05]

Done.

   const base::Value* path_value = nullptr;
-  if (!icons->Get(kExtensionLargeIcon, &path_value))
+  if (!dictionary.Get(key, &path_value))
     return base::FilePath();
   if (!base::GetValueAsFilePath(*path_value, &path))
     return base::FilePath();
+  // Path components ("..") are not allowed.
+  if (path.ReferencesParent())
+    return base::FilePath();
 
   return install_dir.Append(path);
 }
 
+base::FilePath GetLargeIconPath(const base::DictionaryValue& manifest,
+                                const base::FilePath& install_dir) {
+  const base::DictionaryValue* icons = nullptr;
+  if (!manifest.GetDictionary(kExtensionIcons, &icons))
+    return base::FilePath();
+
+  return GetSafeFilePath(*icons, kExtensionLargeIcon, install_dir);
+}
+
 base::FilePath GetRawWhitelistPath(const base::DictionaryValue& manifest,
                                    const base::FilePath& install_dir) {
   const base::DictionaryValue* whitelist_dict = nullptr;
   if (!manifest.GetDictionary(kWhitelistedContent, &whitelist_dict))
     return base::FilePath();
 
-  base::FilePath whitelist_file;
-  const base::Value* whitelist_file_value = nullptr;
-  if (!whitelist_dict->Get(kSites, &whitelist_file_value))
-    return base::FilePath();
-  if (!base::GetValueAsFilePath(*whitelist_file_value, &whitelist_file))
-    return base::FilePath();
-
-  return install_dir.Append(whitelist_file);
+  return GetSafeFilePath(*whitelist_dict, kSites, install_dir);
 }
 
 base::FilePath GetSanitizedWhitelistPath(const std::string& crx_id) {