[PPAPI] Quarantine files that are writeable by a Pepper plugin.

content/browser/renderer_host/pepper/pepper_file_io_host.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/pepper/pepper_file_io_host.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback.h"
-#include "base/callback_helpers.h"
 #include "base/files/file_util_proxy.h"
 #include "base/memory/weak_ptr.h"
+#include "base/task_runner_util.h"
 #include "content/browser/renderer_host/pepper/pepper_file_ref_host.h"
 #include "content/browser/renderer_host/pepper/pepper_file_system_browser_host.h"
 #include "content/browser/renderer_host/pepper/pepper_security_helper.h"
 #include "content/common/fileapi/file_system_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/content_client.h"
+#include "content/public/common/quarantine.h"
 #include "ipc/ipc_platform_file.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/ppb_file_io.h"
 #include "ppapi/host/dispatch_host_message.h"
 #include "ppapi/host/ppapi_host.h"
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/shared_impl/file_system_util.h"
 #include "ppapi/shared_impl/file_type_conversion.h"
 #include "ppapi/shared_impl/time_conversion.h"
 #include "storage/browser/fileapi/file_observers.h"
@@ skipping 246 matching lines @@
                      reply_context,
                      base::Passed(&file)));
       return;
     }
   }
 
   DCHECK(!file_.IsValid());
   base::File::Error error =
       file.IsValid() ? base::File::FILE_OK : file.error_details();
   file_.SetFile(std::move(file));
-  OnOpenProxyCallback(reply_context, error);
+  SendFileOpenReply(reply_context, error);
 }
 
 void PepperFileIOHost::GotResolvedRenderProcessId(
     ppapi::host::ReplyMessageContext reply_context,
     base::FilePath path,
     int file_flags,
     base::ProcessId resolved_render_process_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   resolved_render_process_id_ = resolved_render_process_id;
-  file_.CreateOrOpen(
-      path,
-      file_flags,
-      base::Bind(&PepperFileIOHost::OnOpenProxyCallback,
-                 AsWeakPtr(),
-                 reply_context));
+  file_.CreateOrOpen(path, file_flags,
+                     base::Bind(&PepperFileIOHost::OnLocalFileOpened,
+                                AsWeakPtr(), reply_context, path));
 }
 
 int32_t PepperFileIOHost::OnHostMsgTouch(
     ppapi::host::HostMessageContext* context,
     PP_Time last_access_time,
     PP_Time last_modified_time) {
   int32_t rv = state_manager_.CheckOperationState(
       FileIOStateManager::OPERATION_EXCLUSIVE, true);
   if (rv != PP_OK)
     return rv;
@@ skipping 71 matching lines @@
 
 void PepperFileIOHost::DidOpenQuotaFile(
     ppapi::host::ReplyMessageContext reply_context,
     base::File file,
     int64_t max_written_offset) {
   DCHECK(!file_.IsValid());
   DCHECK(file.IsValid());
   max_written_offset_ = max_written_offset;
   file_.SetFile(std::move(file));
 
-  OnOpenProxyCallback(reply_context, base::File::FILE_OK);
+  SendFileOpenReply(reply_context, base::File::FILE_OK);
 }
 
 void PepperFileIOHost::DidCloseFile(base::File::Error /*error*/) {
   // Silently ignore if we fail to close the file.
   if (!on_close_callback_.is_null()) {
     on_close_callback_.Run();
     on_close_callback_.Reset();
   }
 }
 
@@ skipping 33 matching lines @@
 }
 
 void PepperFileIOHost::ExecutePlatformGeneralCallback(
     ppapi::host::ReplyMessageContext reply_context,
     base::File::Error error_code) {
   reply_context.params.set_result(ppapi::FileErrorToPepperError(error_code));
   host()->SendReply(reply_context, PpapiPluginMsg_FileIO_GeneralReply());
   state_manager_.SetOperationFinished();
 }
 
-void PepperFileIOHost::OnOpenProxyCallback(
+void PepperFileIOHost::OnLocalFileOpened(
+    ppapi::host::ReplyMessageContext reply_context,
+    const base::FilePath& path,
+    base::File::Error error_code) {
+#if defined(OS_WIN) || defined(OS_LINUX)
+  // Quarantining a file before its contents are available is only supported on
+  // Windows and Linux.
+  if (!FileOpenForWrite(open_flags_) || error_code != base::File::FILE_OK) {
+    SendFileOpenReply(reply_context, error_code);
+    return;
+  }
+
+  base::PostTaskAndReplyWithResult(
+      BrowserThread::GetTaskRunnerForThread(BrowserThread::FILE).get(),
+      FROM_HERE,
+      base::Bind(&QuarantineFile, path,
+                 browser_ppapi_host_->GetDocumentURLForInstance(pp_instance()),
+                 GURL(), std::string()),
+      base::Bind(&PepperFileIOHost::OnLocalFileQuarantined, AsWeakPtr(),
+                 reply_context, path));
+#else
+  SendFileOpenReply(reply_context, error_code);
+#endif
+}
+
+#if defined(OS_WIN) || defined(OS_LINUX)
+void PepperFileIOHost::OnLocalFileQuarantined(
+    ppapi::host::ReplyMessageContext reply_context,
+    const base::FilePath& path,
+    QuarantineFileResult quarantine_result) {
+  base::File::Error file_error = (quarantine_result == QuarantineFileResult::OK
+                                      ? base::File::FILE_OK
+                                      : base::File::FILE_ERROR_SECURITY);
+  if (file_error != base::File::FILE_OK && file_.IsValid())
+    file_.Close(base::FileProxy::StatusCallback());
+  SendFileOpenReply(reply_context, file_error);
+}
+#endif
+
+void PepperFileIOHost::SendFileOpenReply(
     ppapi::host::ReplyMessageContext reply_context,
     base::File::Error error_code) {
   int32_t pp_error = ppapi::FileErrorToPepperError(error_code);
   if (file_.IsValid() && !AddFileToReplyContext(open_flags_, &reply_context))
     pp_error = PP_ERROR_FAILED;
 
   PP_Resource quota_file_system = 0;
   if (pp_error == PP_OK) {
     state_manager_.SetOpenSucceed();
     // A non-zero resource id signals the plugin side to check quota.
@@ skipping 23 matching lines @@
 
   ppapi::proxy::SerializedHandle file_handle;
   // A non-zero resource id signals NaClIPCAdapter to create a NaClQuotaDesc.
   PP_Resource quota_file_io = check_quota_ ? pp_resource() : 0;
   file_handle.set_file_handle(transit_file, open_flags, quota_file_io);
   reply_context->params.AppendHandle(file_handle);
   return true;
 }
 
 }  // namespace content