Report invalid blob file paths from the IO thread.

content/browser/indexed_db/database_impl.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/database_impl.h"
 
 #include "content/browser/bad_message.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/indexed_db/indexed_db_connection.h"
 #include "content/browser/indexed_db/indexed_db_context_impl.h"
 #include "content/browser/indexed_db/indexed_db_dispatcher_host.h"
 #include "content/browser/indexed_db/indexed_db_value.h"
 #include "content/common/indexed_db/indexed_db_messages.h"
 #include "storage/browser/blob/blob_storage_context.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
 #include "third_party/WebKit/public/platform/modules/indexeddb/WebIDBDatabaseException.h"
 
 using std::swap;
 
 namespace content {
 
 namespace {
 const char kInvalidBlobUuid[] = "Blob UUID is invalid";
+const char kInvalidBlobFilePath[] = "Blob file path is invalid";
 }  // namespace
 
 class DatabaseImpl::IDBThreadHelper {
  public:
   IDBThreadHelper(std::unique_ptr<IndexedDBConnection> connection,
                   const url::Origin& origin,
                   scoped_refptr<IndexedDBDispatcherHost> dispatcher_host);
   ~IDBThreadHelper();
 
   void CreateObjectStore(int64_t transaction_id,
@@ skipping 27 matching lines @@
               int64_t object_store_id,
               int64_t index_id,
               const IndexedDBKeyRange& key_range,
               bool key_only,
               int64_t max_count,
               scoped_refptr<IndexedDBCallbacks> callbacks);
   void Put(int64_t transaction_id,
            int64_t object_store_id,
            ::indexed_db::mojom::ValuePtr value,
            std::vector<std::unique_ptr<storage::BlobDataHandle>> handles,
+           std::vector<IndexedDBBlobInfo> blob_info,
            const IndexedDBKey& key,
            blink::WebIDBPutMode mode,
            const std::vector<IndexedDBIndexKeys>& index_keys,
            scoped_refptr<IndexedDBCallbacks> callbacks);
   void SetIndexKeys(int64_t transaction_id,
                     int64_t object_store_id,
                     const IndexedDBKey& primary_key,
                     const std::vector<IndexedDBIndexKeys>& index_keys);
   void SetIndexesReady(int64_t transaction_id,
                        int64_t object_store_id,
@@ skipping 163 matching lines @@
 }
 
 void DatabaseImpl::Put(
     int64_t transaction_id,
     int64_t object_store_id,
     ::indexed_db::mojom::ValuePtr value,
     const IndexedDBKey& key,
     blink::WebIDBPutMode mode,
     const std::vector<IndexedDBIndexKeys>& index_keys,
     ::indexed_db::mojom::CallbacksAssociatedPtrInfo callbacks_info) {
-  std::vector<std::unique_ptr<storage::BlobDataHandle>> handles;
-  for (const auto& info : value->blob_or_file_info) {
+  ChildProcessSecurityPolicyImpl* policy =
+      ChildProcessSecurityPolicyImpl::GetInstance();
+
+  std::vector<std::unique_ptr<storage::BlobDataHandle>> handles(
+      value->blob_or_file_info.size());
+  std::vector<IndexedDBBlobInfo> blob_info(value->blob_or_file_info.size());
+  for (size_t i = 0; i < value->blob_or_file_info.size(); ++i) {
+    ::indexed_db::mojom::BlobInfoPtr& info = value->blob_or_file_info[i];
+
     std::unique_ptr<storage::BlobDataHandle> handle =
         dispatcher_host_->blob_storage_context()->GetBlobDataFromUUID(
             info->uuid);
     if (!handle) {
       mojo::ReportBadMessage(kInvalidBlobUuid);
       return;
     }
-    handles.push_back(std::move(handle));
+    handles[i] = std::move(handle);
+
+    if (info->file) {
+      if (!info->file->path.empty() &&
+          !policy->CanReadFile(dispatcher_host_->ipc_process_id(),
+                               info->file->path)) {
+        mojo::ReportBadMessage(kInvalidBlobFilePath);
+        return;
+      }
+      blob_info[i] = IndexedDBBlobInfo(info->uuid, info->file->path,
+                                       info->file->name, info->mime_type);
+      if (info->size != static_cast<uint64_t>(-1)) {

[cmumford, 2016/11/21 21:11:56]

Why is BlobInfo.size currently an unsigned 64-bit int? WebBlobInfo.size is
signed, and so is IndexedDBBlobInfo.

+        blob_info[i].set_last_modified(info->file->last_modified);
+        blob_info[i].set_size(info->size);
+      }
+    } else {
+      blob_info[i] = IndexedDBBlobInfo(info->uuid, info->mime_type, info->size);
+    }
   }
 
   scoped_refptr<IndexedDBCallbacks> callbacks(new IndexedDBCallbacks(
       dispatcher_host_.get(), origin_, std::move(callbacks_info)));
 
   idb_runner_->PostTask(
-      FROM_HERE, base::Bind(&IDBThreadHelper::Put, base::Unretained(helper_),
-                            transaction_id, object_store_id,
-                            base::Passed(&value), base::Passed(&handles), key,
-                            mode, index_keys, base::Passed(&callbacks)));
+      FROM_HERE,
+      base::Bind(&IDBThreadHelper::Put, base::Unretained(helper_),
+                 transaction_id, object_store_id, base::Passed(&value),
+                 base::Passed(&handles), base::Passed(&blob_info), key, mode,
+                 index_keys, base::Passed(&callbacks)));
 }
 
 void DatabaseImpl::SetIndexKeys(
     int64_t transaction_id,
     int64_t object_store_id,
     const IndexedDBKey& primary_key,
     const std::vector<IndexedDBIndexKeys>& index_keys) {
   idb_runner_->PostTask(
       FROM_HERE,
       base::Bind(&IDBThreadHelper::SetIndexKeys, base::Unretained(helper_),
@@ skipping 256 matching lines @@
       dispatcher_host_->HostTransactionId(transaction_id), object_store_id,
       index_id, base::MakeUnique<IndexedDBKeyRange>(key_range), key_only,
       max_count, std::move(callbacks));
 }
 
 void DatabaseImpl::IDBThreadHelper::Put(
     int64_t transaction_id,
     int64_t object_store_id,
     ::indexed_db::mojom::ValuePtr mojo_value,
     std::vector<std::unique_ptr<storage::BlobDataHandle>> handles,
+    std::vector<IndexedDBBlobInfo> blob_info,
     const IndexedDBKey& key,
     blink::WebIDBPutMode mode,
     const std::vector<IndexedDBIndexKeys>& index_keys,
     scoped_refptr<IndexedDBCallbacks> callbacks) {
   if (!connection_->IsConnected())
     return;
 
   int64_t host_transaction_id =
       dispatcher_host_->HostTransactionId(transaction_id);
-
-  ChildProcessSecurityPolicyImpl* policy =
-      ChildProcessSecurityPolicyImpl::GetInstance();
-  std::vector<IndexedDBBlobInfo> blob_info(
-      mojo_value->blob_or_file_info.size());
-  for (size_t i = 0; i < mojo_value->blob_or_file_info.size(); ++i) {
-    const auto& info = mojo_value->blob_or_file_info[i];
-    if (info->file) {
-      if (!info->file->path.empty()) {
-        if (!policy->CanReadFile(dispatcher_host_->ipc_process_id(),
-                                 info->file->path)) {
-          bad_message::ReceivedBadMessage(dispatcher_host_.get(),
-                                          bad_message::IDBDH_CAN_READ_FILE);
-          return;
-        }
-      }
-      blob_info[i] = IndexedDBBlobInfo(info->uuid, info->file->path,
-                                       info->file->name, info->mime_type);
-      if (info->size != static_cast<uint64_t>(-1)) {
-        blob_info[i].set_last_modified(info->file->last_modified);
-        blob_info[i].set_size(info->size);
-      }
-    } else {
-      blob_info[i] = IndexedDBBlobInfo(info->uuid, info->mime_type, info->size);
-    }
-  }
-
   uint64_t commit_size = mojo_value->bits.size();
   IndexedDBValue value;
   swap(value.bits, mojo_value->bits);
   swap(value.blob_info, blob_info);
   connection_->database()->Put(host_transaction_id, object_store_id, &value,
                                &handles, base::MakeUnique<IndexedDBKey>(key),
                                mode, std::move(callbacks), index_keys);
 
   // Size can't be big enough to overflow because it represents the
   // actual bytes passed through IPC.
@@ skipping 176 matching lines @@
   if (status == storage::kQuotaStatusOk && usage + transaction_size <= quota) {
     connection_->database()->Commit(host_transaction_id);
   } else {
     connection_->database()->Abort(
         host_transaction_id,
         IndexedDBDatabaseError(blink::WebIDBDatabaseExceptionQuotaError));
   }
 }
 
 }  // namespace content