Use better fallback URLs when calling AVScanFile().

content/browser/download/quarantine_win.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/download/quarantine.h"
 
 #include <windows.h>
 
 #include <cguid.h>
 #include <objbase.h>
 #include <shellapi.h>
 #include <shlobj.h>
 #include <shobjidl.h>
+#include <wininet.h>
 
 #include "base/files/file_util.h"
 #include "base/guid.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_restrictions.h"
@@ skipping 140 matching lines @@
 // Typical |save_result| values:
 //   S_OK   : The file was okay. If any viruses were found, they were cleaned.
 //   E_FAIL : Virus infected.
 //   INET_E_SECURITY_PROBLEM : The file was blocked due to security policy.
 //
 // Any other return value indicates an unexpected error during the scan.
 //
 // |full_path| : is the path to the downloaded file. This should be the final
 //               path of the download. Must be present.
 // |source_url|: the source URL for the download. If empty, the source will
-//               not be set.
+//               be set to 'about:internet'.
+// |referrer_url|: the referrer URL for the download. If empty, the referrer
+//               will not be set.
 // |client_guid|: the GUID to be set in the IAttachmentExecute client slot.
 //                Used to identify the app to the system AV function.
 //                If GUID_NULL is passed, no client GUID is set.
 // |save_result|: Receives the result of invoking IAttachmentExecute::Save().
 bool InvokeAttachmentServices(const base::FilePath& full_path,
                               const std::string& source_url,
+                              const std::string& referrer_url,
                               const GUID& client_guid,
                               HRESULT* save_result) {
   base::win::ScopedComPtr<IAttachmentExecute> attachment_services;
   HRESULT hr = attachment_services.CreateInstance(CLSID_AttachmentServices);
   *save_result = S_OK;
 
   if (FAILED(hr)) {
     // The thread must have COM initialized.
     DCHECK_NE(CO_E_NOTINITIALIZED, hr);
     RecordAttachmentServicesResult(
         AttachmentServicesResult::NO_ATTACHMENT_SERVICES);
     return false;
   }
 
+  // Note that it is mandatory to check the return values from here on out. If
+  // setting one of the parameters fails, it could leave the object in a state
+  // where the final Save() call will also fail.
+
   hr = attachment_services->SetClientGuid(client_guid);
   if (FAILED(hr)) {
     RecordAttachmentServicesResult(
         AttachmentServicesResult::FAILED_TO_SET_PARAMETER);
     return false;
   }
 
   hr = attachment_services->SetLocalPath(full_path.value().c_str());
   if (FAILED(hr)) {
     RecordAttachmentServicesResult(
         AttachmentServicesResult::FAILED_TO_SET_PARAMETER);
     return false;
   }
 
-  // Note: SetSource looks like it needs to be called, even if empty.
-  // Docs say it is optional, but it appears not calling it at all sets
-  // a zone that is too restrictive.
-  hr = attachment_services->SetSource(base::UTF8ToWide(source_url).c_str());
+  // The source URL could be empty if it was not a valid URL or was not HTTP/S.
+  // If so, user "about:internet" as a fallback URL. The latter is known to
+  // reliably map to the Internet zone.
+  //
+  // In addition, URLs that are longer than INTERNET_MAX_URL_LENGTH are also
+  // known to cause problems for URLMon. Hence also use "about:internet" in
+  // these cases. See http://crbug.com/601538.
+  hr = attachment_services->SetSource(
+      source_url.empty() || source_url.size() > INTERNET_MAX_URL_LENGTH
+          ? L"about:internet"
+          : base::UTF8ToWide(source_url).c_str());
   if (FAILED(hr)) {
     RecordAttachmentServicesResult(
         AttachmentServicesResult::FAILED_TO_SET_PARAMETER);
     return false;
   }
 
+  // Only set referrer if one is present and shorter than
+  // INTERNET_MAX_URL_LENGTH. Also, the source_url is authoritative for
+  // determining the relative danger of |full_path| so we don't consider it an
+  // error if we have to skip the |referrer_url|.
+  if (!referrer_url.empty() && referrer_url.size() < INTERNET_MAX_URL_LENGTH) {
+    hr = attachment_services->SetReferrer(
+        base::UTF8ToWide(referrer_url).c_str());
+    if (FAILED(hr)) {
+      RecordAttachmentServicesResult(
+          AttachmentServicesResult::FAILED_TO_SET_PARAMETER);
+      return false;
+    }
+  }
+
   {
     // This method has been known to take longer than 10 seconds in some
     // instances.
     SCOPED_UMA_HISTOGRAM_LONG_TIMER("Download.AttachmentServices.Duration");
     *save_result = attachment_services->Save();
   }
   RecordAttachmentServicesSaveResult(full_path, *save_result);
   return true;
 }
 
@@ skipping 44 matching lines @@
   }
 
   if (file_size == 0 || IsEqualGUID(guid, GUID_NULL)) {
     // Calling InvokeAttachmentServices on an empty file can result in the file
     // being deleted.  Also an anti-virus scan doesn't make a lot of sense to
     // perform on an empty file.
     return SetInternetZoneIdentifierDirectly(file);
   }
 
   HRESULT save_result = S_OK;
-  bool attachment_services_available =
-      InvokeAttachmentServices(file, source_url.spec(), guid, &save_result);
+  bool attachment_services_available = InvokeAttachmentServices(
+      file, source_url.spec(), referrer_url.spec(), guid, &save_result);
   if (!attachment_services_available)
     return SetInternetZoneIdentifierDirectly(file);
 
   // If the download file is missing after the call, then treat this as an
   // interrupted download.
   //
   // If InvokeAttachmentServices() failed, but the downloaded file is still
   // around, then don't interrupt the download. Attachment Execution Services
   // deletes the submitted file if the downloaded file is blocked by policy or
   // if it was found to be infected.
   //
   // If the file is still there, then the error could be due to Windows
   // Attachment Services not being available or some other error during the AES
   // invocation. In either case, we don't surface the error to the user.
   if (!base::PathExists(file))
     return FailedSaveResultToQuarantineResult(save_result);
   return QuarantineFileResult::OK;
 }
 
 }  // namespace content