Verify intent signatures.

chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package org.chromium.chrome.browser.externalnav;
 
 import android.Manifest.permission;
 import android.app.Activity;
 import android.content.Context;
 import android.content.DialogInterface;
 import android.content.DialogInterface.OnCancelListener;
 import android.content.DialogInterface.OnClickListener;
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.content.pm.PackageManager;
 import android.content.pm.ResolveInfo;
+import android.content.pm.Signature;
 import android.net.Uri;
 import android.os.Build;
 import android.os.StrictMode;
 import android.os.TransactionTooLargeException;
 import android.provider.Browser;
 import android.provider.Telephony;
 import android.support.v7.app.AlertDialog;
 import android.text.TextUtils;
 import android.util.Log;
 import android.webkit.MimeTypeMap;
@@ skipping 15 matching lines @@
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.util.FeatureUtilities;
 import org.chromium.chrome.browser.util.UrlUtilities;
 import org.chromium.content_public.browser.LoadUrlParams;
 import org.chromium.content_public.common.Referrer;
 import org.chromium.ui.base.PageTransition;
 import org.chromium.ui.base.WindowAndroid;
 import org.chromium.ui.base.WindowAndroid.PermissionCallback;
 import org.chromium.webapk.lib.client.WebApkValidator;
 
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
 import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 /**
  * The main implementation of the {@link ExternalNavigationDelegate}.
  */
 public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegate {
     private static final String TAG = "ExternalNavigationDelegateImpl";
     private static final String PDF_VIEWER = "com.google.android.apps.docs";
     private static final String PDF_MIME = "application/pdf";
     private static final String PDF_SUFFIX = ".pdf";
     private static final String PDF_EXTENSION = "pdf";
@@ skipping 471 matching lines @@
         if (TextUtils.isEmpty(fileExtension)) return false;
 
         return PDF_EXTENSION.equals(fileExtension);
     }
 
     @Override
     public void maybeRecordAppHandlersInIntent(Intent intent, List<ResolveInfo> infos) {
         intent.putExtra(IntentHandler.EXTRA_EXTERNAL_NAV_PACKAGES,
                 getSpecializedHandlersWithFilter(infos, null));
     }
+
+
+    @Override
+    public Set<String> getPackageSHA256Fingerprints(String pkgName)
+            throws PackageManager.NameNotFoundException {
+        PackageManager pm = getAvailableContext().getPackageManager();
+        Signature[] signatures = pm.getPackageInfo(pkgName,
+                PackageManager.GET_SIGNATURES).signatures;

[please use gerrit instead, 2016/07/29 16:59:52]

Surround lines 556-557 with try-catch block for NameNotFoundException. Return
null if the exception is thrown.

+        HashSet<String> fingerPrint256Set = new HashSet<String>();
+        if (signatures.length > 0) {
+            for (Signature each : signatures) {
+                String fingerPrint = getSha256(each.toByteArray());

[please use gerrit instead, 2016/07/29 16:59:52]

if (fingerPrint == null) return null;

Use null to indicate failure.

+                fingerPrint256Set.add(fingerPrint);
+            }
+        }
+        return fingerPrint256Set;
+    }
+
+    /**
+     * Compute sha256 fingerprint from signature using MessageDigest.
+     *
+     * @param signature The signature to process.
+     * @return The hex string for the fingerprint.

[please use gerrit instead, 2016/07/29 16:59:52]

@return The hex string for the fingerprint or null on failure.

+     */
+    private String getSha256(byte[] signature) {
+        MessageDigest digester;
+        try {
+            digester = MessageDigest.getInstance("SHA-256");
+        } catch (NoSuchAlgorithmException e) {
+            return "";

[please use gerrit instead, 2016/07/29 16:59:52]

return null; 

Use null to indicate failure.

+        }
+        digester.update(signature);
+        return byteArrayToHexString(digester.digest());
+    }
+
+    /**
+     * Convert bytes to a hex string.
+     *
+     * @param bytes The bytes to convert into a string.
+     * @return The hex string for the bytes.
+     */
+    private String byteArrayToHexString(byte[] bytes) {
+        if (bytes.length == 0) {
+            return "";
+        }
+        StringBuilder data = new StringBuilder();
+        for (byte b : bytes) {
+            data.append(Integer.toHexString((b >> 4) & 0x0f));
+            data.append(Integer.toHexString(b & 0x0f));
+        }
+        return data.toString().toUpperCase();
+    }
+
 }