Adding app_shim executable on Windows.

chrome/app_shim/app_shim_win.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <string>
+
+#include "base/command_line.h"
+#include "base/files/file_path.h"
+#include "base/logging.h"
+#include "base/process/launch.h"
+
+#include <windows.h>
+
+namespace {
+
+// Return codes.
+const int kOK = 0;
+const int kNoProgram = 1;
+const int kLaunchFailure = 2;
+
+}  // namespace
+
+// This program takes a full Windows command line as command-line arguments, and
+// executes it. It terminates as soon as the program is launched. It is intended
+// as a small shim for running chrome.exe; in particular, so that file types can
+// be associated with Chrome apps, with a custom name (and in some cases, icon)
+// rather than simply the name of the Chrome binary.
+//
+// Usage: win_app_shim -- PATH_TO_CHROME_EXE [CHROME_ARGS...]
+//
+// The -- is required if switches are to be passed to Chrome; any switches
+// before the -- will be interpreted by win_app_shim, and not passed to Chrome.
+int WINAPI WinMain(HINSTANCE instance,
+                   HINSTANCE prev_instance,
+                   char* /*command_line*/,
+                   int show_command) {
+  CommandLine::Init(0, nullptr);
+
+  // Log to stderr. Otherwise it will log to a file by default.
+  logging::LoggingSettings logging_settings;
+  logging_settings.logging_dest = logging::LOG_TO_SYSTEM_DEBUG_LOG;
+  logging::InitLogging(logging_settings);
+
+  // Get the command line for the subprocess, consisting of the arguments (but
+  // not switches) to this binary. This gets everything after the "--". The
+  // first argument should be the location of the binary to run (full path to
+  // chrome.exe).
+  // TODO(mgiuca): Consider implicitly finding chrome.exe through the registry
+  // somehow, instead of taking it as a command-line argument.

[Matt Giuca, 2014/10/24 09:45:46]

I've left this TODO in so maybe we can have a discussion about it. Someone (I've
forgotten who) suggested that I do this.

I see there is code to do this in
chrome/installer/launcher_support/chrome_launcher_support.h, but I'm not sure if
it will work in this case --- it needs to open the exact same Chrome as that
which created it. (For example, Chrome Canary or Chrome Stable.) Will this work?

It also makes it hard to test, since regular Chromium won't be installed in the
registry in this way.

[jackhou1, 2014/10/26 23:16:43]

Yeah that's a good point. The only problem I can think of is if Chrome is
installed at a user level, then later at a system level. The system level
install will replace the user level one, so hard coded chrome.exe paths will
break. If there's no security issue with passing the path, we could do both, and
only use the hard coded path for Chromium.

[Matt Giuca, 2014/10/27 00:16:16]

SECURITY: Can you comment on whether it is safe to have the shim binary able to
open any arbitrary executable on the system (as opposed to only being able to
open Chrome).

The way I see it, an attacker can use this binary to run an arbitrary command
line. But this is only possible if the attacker is able to run the shim with an
arbitrary command line --- so it doesn't give you any new privileges you didn't
already have. The only concern we have is that it would mean a Google-signed
binary is potentially able to execute any other binary on the system. Does that
have any negative implications?

+  CommandLine command_line(CommandLine::ForCurrentProcess()->GetArgs());
+  if (command_line.GetProgram().empty()) {
+    std::string basename = CommandLine::ForCurrentProcess()
+                               ->GetProgram()
+                               .BaseName()
+                               .AsUTF8Unsafe();
+    LOG(ERROR) << "Usage: " << basename << " -- PATH_TO_CHROME_EXE [ARGS...]";
+    return kNoProgram;
+  }
+
+  base::LaunchOptions options;
+  if (!base::LaunchProcess(command_line, options, nullptr))
+    return kLaunchFailure;
+
+  return kOK;
+}