Stop base::OpenFile from leaking fds/handles into child procs.

base/files/file_util_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
 #include <fstream>
+#include <initializer_list>
 #include <set>
 #include <utility>
 #include <vector>
 
 #include "base/base_paths.h"
 #include "base/environment.h"
 #include "base/files/file_enumerator.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_file.h"
@@ skipping 219 matching lines @@
 std::wstring ReadTextFile(const FilePath& filename) {
   wchar_t contents[64];
   std::wifstream file;
   file.open(filename.value().c_str());
   EXPECT_TRUE(file.is_open());
   file.getline(contents, arraysize(contents));
   file.close();
   return std::wstring(contents);
 }
 
+// Sets |is_inheritable| to indicate whether or not |stream| is set up to be
+// inerhited into child processes (i.e., HANDLE_FLAG_INHERIT is set on the
+// underlying handle on Windows, or FD_CLOEXEC is not set on the underlying file
+// descriptor on POSIX). Calls to this function must be wrapped with
+// ASSERT_NO_FATAL_FAILURE to properly abort tests in case of fatal failure.
+void GetIsInheritable(FILE* stream, bool* is_inheritable) {
+#if defined(OS_WIN)
+  HANDLE handle = reinterpret_cast<HANDLE>(_get_osfhandle(_fileno(stream)));
+  ASSERT_NE(INVALID_HANDLE_VALUE, handle);
+
+  DWORD info = 0;
+  ASSERT_EQ(TRUE, ::GetHandleInformation(handle, &info));
+  *is_inheritable = ((info & HANDLE_FLAG_INHERIT) != 0);
+#elif defined(OS_POSIX)
+  int fd = fileno(stream);
+  ASSERT_NE(-1, fd);
+  int flags = fcntl(fd, F_GETFD, 0);
+  ASSERT_NE(-1, flags);
+  *is_inheritable = ((flags & FD_CLOEXEC) == 0);
+#else
+  FAIL() << "Unimplemented";
+#endif
+}
+
 TEST_F(FileUtilTest, FileAndDirectorySize) {
   // Create three files of 20, 30 and 3 chars (utf8). ComputeDirectorySize
   // should return 53 bytes.
   FilePath file_01 = temp_dir_.GetPath().Append(FPL("The file 01.txt"));
   CreateTextFile(file_01, L"12345678901234567890");
   int64_t size_f1 = 0;
   ASSERT_TRUE(GetFileSize(file_01, &size_f1));
   EXPECT_EQ(20ll, size_f1);
 
   FilePath subdir_path = temp_dir_.GetPath().Append(FPL("Level2"));
@@ skipping 1445 matching lines @@
   // Restore the original $TMP.
   if (original_tmp) {
     ::_tputenv_s(kTmpKey, original_tmp);
     free(original_tmp);
   } else {
     ::_tputenv_s(kTmpKey, _T(""));
   }
 }
 #endif  // OS_WIN
 
+// Test that files opened by OpenFile are not set up for inheritance into child
+// procs.
+TEST_F(FileUtilTest, OpenFileNoInheritance) {
+  FilePath file_path(temp_dir_.GetPath().Append(FPL("a_file")));
+
+  for (const char* mode : {"wb", "r,ccs=UNICODE"}) {
+    SCOPED_TRACE(mode);
+    ASSERT_NO_FATAL_FAILURE(CreateTextFile(file_path, L"Geepers"));
+    FILE* file = OpenFile(file_path, mode);
+    ASSERT_NE(nullptr, file);
+    bool is_inheritable = true;
+    ASSERT_NO_FATAL_FAILURE(GetIsInheritable(file, &is_inheritable));

[Mark Mentovai, 2017/02/11 00:52:29]

You do want to reach CloseFile() even if this fails, but the assert aspect of
this will cause it to return immediately instead.

[grt (UTC plus 2), 2017/02/13 07:53:28]

Good point. Moved CloseFile into a ScopedClosureRunner so that it's run
unconditionally.

+    EXPECT_FALSE(is_inheritable);
+    ASSERT_TRUE(CloseFile(file));
+    ASSERT_TRUE(DeleteFile(file_path, false));
+  }
+}
+
 TEST_F(FileUtilTest, CreateTemporaryFileTest) {
   FilePath temp_files[3];
   for (int i = 0; i < 3; i++) {
     ASSERT_TRUE(CreateTemporaryFile(&(temp_files[i])));
     EXPECT_TRUE(PathExists(temp_files[i]));
     EXPECT_FALSE(DirectoryExists(temp_files[i]));
   }
   for (int i = 0; i < 3; i++)
     EXPECT_FALSE(temp_files[i] == temp_files[(i+1)%3]);
   for (int i = 0; i < 3; i++)
@@ skipping 844 matching lines @@
   // Trying to close it should crash. This is important for security.
   EXPECT_DEATH(CloseWithScopedFD(fds[1]), "");
 #endif
 }
 
 #endif  // defined(OS_POSIX)
 
 }  // namespace
 
 }  // namespace base