Remove untrusted sources installation flow.

chrome/browser/android/webapk/webapk_installer.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/android/webapk/webapk_installer.h"
 
 #include "base/android/build_info.h"
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
 #include "base/android/path_utils.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"

[pkotwicz, 2017/04/04 19:06:07]

Nit: You can remove this include

[Yaron, 2017/04/04 19:49:08]

Done.

 #include "base/files/file_util.h"

[pkotwicz, 2017/04/04 19:06:07]

Nit: You can remove this include

[Yaron, 2017/04/04 19:49:08]

Done.

 #include "base/memory/ref_counted.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task_runner_util.h"
 #include "base/threading/sequenced_worker_pool.h"
 #include "base/timer/elapsed_timer.h"
 #include "chrome/browser/android/shortcut_helper.h"
 #include "chrome/browser/android/webapk/chrome_webapk_host.h"
@@ skipping 22 matching lines @@
     "https://webapk.googleapis.com/v1/webApks/"
     "?alt=proto&key=AIzaSyAoI6v-F31-3t9NunLYEiKcPIqgTJIUZBw";
 
 // The MIME type of the POST data sent to the server.
 const char kProtoMimeType[] = "application/x-protobuf";
 
 // The default number of milliseconds to wait for the WebAPK download URL from
 // the WebAPK server.
 const int kWebApkDownloadUrlTimeoutMs = 60000;
 
-// The default number of milliseconds to wait for the WebAPK download to
-// complete.
-const int kDownloadTimeoutMs = 60000;
-
-const int kWorldReadableFilePermission = base::FILE_PERMISSION_READ_BY_USER |
-                                         base::FILE_PERMISSION_READ_BY_GROUP |
-                                         base::FILE_PERMISSION_READ_BY_OTHERS;
-const int kDefaultWebApkVersion = 1;
-
 // Returns the WebAPK server URL based on the command line.
 GURL GetServerUrl() {
   base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
   GURL command_line_url(
       command_line->GetSwitchValueASCII(switches::kWebApkServerUrl));
   return command_line_url.is_valid() ? command_line_url
                                      : GURL(kDefaultServerUrl);
 }
 
 // Returns the scope from |info| if it is specified. Otherwise, returns the
@@ skipping 94 matching lines @@
   callback.Run(std::move(webapk));
 }
 
 // Returns task runner for running background tasks.
 scoped_refptr<base::TaskRunner> GetBackgroundTaskRunner() {
   return content::BrowserThread::GetBlockingPool()
       ->GetTaskRunnerWithShutdownBehavior(
           base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
 }
 
-// Creates a directory depending on the type of the task, and set permissions.
-// It also creates any parent directory along the path if doesn't exist,
-// and sets permissions as well.
-// The previously downloaded APKs are deleted in order to clean up unused cached
-// data.
-base::FilePath CreateSubDirAndSetPermissionsInBackground(
-    const base::StringPiece& output_dir_name,
-    const std::string& package_name) {
-  base::FilePath output_root_dir;
-  base::android::GetCacheDirectory(&output_root_dir);
-  base::FilePath webapk_dir = output_root_dir.AppendASCII("webapks");
-  // Creating different downloaded directory for install/update cases is
-  // to prevent deleting the APK which is still in use when an install and an
-  // update happen at the same time. However, it doesn't help the cases of when
-  // mutiple installs (or multiple updates) happen at the same time.
-  base::FilePath output_dir = webapk_dir.AppendASCII(output_dir_name);
-  int posix_permissions = kWorldReadableFilePermission |
-                          base::FILE_PERMISSION_WRITE_BY_USER |
-                          base::FILE_PERMISSION_EXECUTE_BY_USER |
-                          base::FILE_PERMISSION_EXECUTE_BY_OTHERS;
-  if (base::PathExists(output_dir))
-    base::DeleteFile(output_dir, true);
-
-  // Creates the directory to download and sets permissions.
-  if (!base::CreateDirectory(output_dir) ||
-      !base::SetPosixFilePermissions(webapk_dir, posix_permissions) ||
-      !base::SetPosixFilePermissions(output_dir, posix_permissions))
-    return base::FilePath();
-
-  return output_dir;
-}
-
 }  // anonymous namespace
 
 WebApkInstaller::~WebApkInstaller() {
   JNIEnv* env = base::android::AttachCurrentThread();
   Java_WebApkInstaller_destroy(env, java_ref_);
   java_ref_.Reset();
 }
 
 // static
 void WebApkInstaller::InstallAsync(content::BrowserContext* context,
@@ skipping 38 matching lines @@
     int webapk_version,
     const std::map<std::string, std::string>& icon_url_to_murmur2_hash,
     bool is_manifest_stale,
     const FinishCallback& finish_callback) {
   installer->UpdateAsync(webapk_package, webapk_version,
                          icon_url_to_murmur2_hash, is_manifest_stale,
                          finish_callback);
 }
 
 void WebApkInstaller::SetTimeoutMs(int timeout_ms) {
-  webapk_download_url_timeout_ms_ = timeout_ms;
-  download_timeout_ms_ = timeout_ms;
+  webapk_server_timeout_ms_ = timeout_ms;
 }
 
 void WebApkInstaller::OnInstallFinished(
     JNIEnv* env,
     const base::android::JavaParamRef<jobject>& obj,
     jint result) {
   OnResult(static_cast<WebApkInstallResult>(result));
 }
 
 void WebApkInstaller::BuildWebApkProtoInBackgroundForTesting(
     const base::Callback<void(std::unique_ptr<webapk::WebApk>)>& callback,
     const std::map<std::string, std::string>& icon_url_to_murmur2_hash,
     bool is_manifest_stale) {
   base::PostTaskAndReplyWithResult(
       GetBackgroundTaskRunner().get(), FROM_HERE,
       base::Bind(&BuildWebApkProtoInBackground, shortcut_info_, shortcut_icon_,
                  icon_url_to_murmur2_hash, is_manifest_stale),
       base::Bind(&OnWebApkProtoBuilt, callback));
 }
 
 // static
 bool WebApkInstaller::Register(JNIEnv* env) {
   return RegisterNativesImpl(env);
 }
 
-void WebApkInstaller::InstallDownloadedWebApk(
-    JNIEnv* env,
-    const base::android::ScopedJavaLocalRef<jstring>& java_file_path,
-    const base::android::ScopedJavaLocalRef<jstring>& java_package_name) {
-  Java_WebApkInstaller_installDownloadedWebApkAsync(
-      env, java_ref_, java_file_path, java_package_name);
-}
-
-void WebApkInstaller::UpdateUsingDownloadedWebApk(
-    JNIEnv* env,
-    const base::android::ScopedJavaLocalRef<jstring>& java_file_path) {
-  Java_WebApkInstaller_updateUsingDownloadedWebApkAsync(env, java_ref_,
-                                                        java_file_path);
-}
-
-bool WebApkInstaller::CanUseGooglePlayInstallService() {
+bool WebApkInstaller::CanInstallWebApks() {
   return ChromeWebApkHost::GetGooglePlayInstallState() ==
          GooglePlayInstallState::SUPPORTED;
 }
 
-void WebApkInstaller::InstallOrUpdateWebApkFromGooglePlay(
-    const std::string& package_name,
-    int version,
-    const std::string& token) {
+void WebApkInstaller::InstallOrUpdateWebApk(const std::string& package_name,
+                                            int version,
+                                            const std::string& token) {
   webapk_package_ = package_name;
 
   JNIEnv* env = base::android::AttachCurrentThread();
   base::android::ScopedJavaLocalRef<jstring> java_webapk_package =
       base::android::ConvertUTF8ToJavaString(env, webapk_package_);
   base::android::ScopedJavaLocalRef<jstring> java_title =
       base::android::ConvertUTF16ToJavaString(env, shortcut_info_.user_title);
   base::android::ScopedJavaLocalRef<jstring> java_token =
       base::android::ConvertUTF8ToJavaString(env, token);
   base::android::ScopedJavaLocalRef<jstring> java_url =
       base::android::ConvertUTF8ToJavaString(env, shortcut_info_.url.spec());
 
   if (task_type_ == WebApkInstaller::INSTALL) {
-    Java_WebApkInstaller_installWebApkFromGooglePlayAsync(
-        env, java_ref_, java_webapk_package, version, java_title, java_token,
-        java_url);
+    Java_WebApkInstaller_installWebApkAsync(env, java_ref_, java_webapk_package,
+                                            version, java_title, java_token,
+                                            java_url);
   } else {
-    Java_WebApkInstaller_updateAsyncFromGooglePlay(
-        env, java_ref_, java_webapk_package, version, java_title, java_token,
-        java_url);
+    Java_WebApkInstaller_updateAsync(env, java_ref_, java_webapk_package,
+                                     version, java_title, java_token, java_url);
   }
 }
 
 void WebApkInstaller::OnResult(WebApkInstallResult result) {
   weak_ptr_factory_.InvalidateWeakPtrs();
   finish_callback_.Run(result, relax_updates_, webapk_package_);
 
   if (task_type_ == WebApkInstaller::INSTALL) {
     if (result == WebApkInstallResult::SUCCESS) {
       webapk::TrackInstallDuration(install_duration_timer_->Elapsed());
       webapk::TrackInstallEvent(webapk::INSTALL_COMPLETED);
     } else {
       DVLOG(1) << "The WebAPK installation failed.";
       webapk::TrackInstallEvent(webapk::INSTALL_FAILED);
     }
   }
 
   delete this;
 }
 
 WebApkInstaller::WebApkInstaller(content::BrowserContext* browser_context,
                                  const ShortcutInfo& shortcut_info,
                                  const SkBitmap& shortcut_icon)
     : request_context_getter_(
           Profile::FromBrowserContext(browser_context)->GetRequestContext()),
       shortcut_info_(shortcut_info),
       shortcut_icon_(shortcut_icon),
       server_url_(GetServerUrl()),
-      webapk_download_url_timeout_ms_(kWebApkDownloadUrlTimeoutMs),
-      download_timeout_ms_(kDownloadTimeoutMs),
+      webapk_server_timeout_ms_(kWebApkDownloadUrlTimeoutMs),
       relax_updates_(false),
-      webapk_version_(kDefaultWebApkVersion),
       task_type_(UNDEFINED),
       weak_ptr_factory_(this) {
   CreateJavaRef();
 }
 
 void WebApkInstaller::CreateJavaRef() {
   JNIEnv* env = base::android::AttachCurrentThread();
   java_ref_.Reset(
       Java_WebApkInstaller_create(env, reinterpret_cast<intptr_t>(this)));
 }
@@ skipping 18 matching lines @@
                  weak_ptr_factory_.GetWeakPtr()));
 }
 
 void WebApkInstaller::UpdateAsync(
     const std::string& webapk_package,
     int webapk_version,
     const std::map<std::string, std::string>& icon_url_to_murmur2_hash,
     bool is_manifest_stale,
     const FinishCallback& finish_callback) {
   webapk_package_ = webapk_package;
-  webapk_version_ = webapk_version;
   finish_callback_ = finish_callback;
   task_type_ = UPDATE;
 
   base::PostTaskAndReplyWithResult(
       GetBackgroundTaskRunner().get(), FROM_HERE,
       base::Bind(&BuildWebApkProtoInBackground, shortcut_info_, shortcut_icon_,
                  icon_url_to_murmur2_hash, is_manifest_stale),
       base::Bind(&WebApkInstaller::SendUpdateWebApkRequest,
-                 weak_ptr_factory_.GetWeakPtr()));
+                 weak_ptr_factory_.GetWeakPtr(), webapk_version));
 }
 
 void WebApkInstaller::OnURLFetchComplete(const net::URLFetcher* source) {
   timer_.Stop();
 
   if (!source->GetStatus().is_success() ||
       source->GetResponseCode() != net::HTTP_OK) {
     LOG(WARNING) << base::StringPrintf(
         "WebAPK server returned response code %d.", source->GetResponseCode());
     OnResult(WebApkInstallResult::FAILURE);
     return;
   }
 
   std::string response_string;
   source->GetResponseAsString(&response_string);
 
   std::unique_ptr<webapk::WebApkResponse> response(new webapk::WebApkResponse);
   if (!response->ParseFromString(response_string)) {
     LOG(WARNING) << "WebAPK server did not return proto.";
     OnResult(WebApkInstallResult::FAILURE);
     return;
   }
 
   GURL signed_download_url(response->signed_download_url());
   if (task_type_ == UPDATE && signed_download_url.is_empty()) {

[pkotwicz, 2017/04/04 19:06:07]

In a separate CL, we should clean this up. Does the server send an empty WAM
token if the server does not have a newer WebAPK to update to?
Ideally we would not deal with the download URL at all

[Yaron, 2017/04/04 19:49:08]

I know it sends an empty URL but don't know about WAM token. +Glenn

[hartmanng, 2017/04/04 19:53:33]

Yes, the server will send both an empty URL and an empty WAM token.

[Yaron, 2017/04/04 19:56:58]

Err but actually I don't expect play client to back off on update requests so we
might have to keep this

     // https://crbug.com/680131. The server sends an empty URL if the server
     // does not have a newer WebAPK to update to.
     relax_updates_ = response->relax_updates();
     OnResult(WebApkInstallResult::SUCCESS);
     return;
   }
 
   if (!signed_download_url.is_valid() || response->package_name().empty()) {
     LOG(WARNING) << "WebAPK server returned incomplete proto.";
     OnResult(WebApkInstallResult::FAILURE);
     return;
   }
 
-  if (CanUseGooglePlayInstallService()) {
-    int version = 1;
-    base::StringToInt(response->version(), &version);
-    InstallOrUpdateWebApkFromGooglePlay(response->package_name(), version,
-                                        response->token());
+  if (!CanInstallWebApks()) {
+    OnResult(WebApkInstallResult::FAILURE);
     return;
   }
 
-  OnGotWebApkDownloadUrl(signed_download_url, response->package_name());
+  int version = 1;
+  base::StringToInt(response->version(), &version);
+  InstallOrUpdateWebApk(response->package_name(), version, response->token());
 }
 
 void WebApkInstaller::OnGotIconMurmur2Hash(
     const std::string& icon_murmur2_hash) {
   // An empty hash indicates that |icon_hasher_| encountered an error.
   if (icon_murmur2_hash.empty()) {
     OnResult(WebApkInstallResult::FAILURE);
     return;
   }
 
@@ skipping 12 matching lines @@
       base::Bind(&WebApkInstaller::SendCreateWebApkRequest,
                  weak_ptr_factory_.GetWeakPtr()));
 }
 
 void WebApkInstaller::SendCreateWebApkRequest(
     std::unique_ptr<webapk::WebApk> webapk) {
   SendRequest(std::move(webapk), server_url_);
 }
 
 void WebApkInstaller::SendUpdateWebApkRequest(
+    int webapk_version,
     std::unique_ptr<webapk::WebApk> webapk) {
   webapk->set_package_name(webapk_package_);
-  webapk->set_version(std::to_string(webapk_version_));
+  webapk->set_version(std::to_string(webapk_version));
 
   SendRequest(std::move(webapk), server_url_);
 }
 
 void WebApkInstaller::SendRequest(std::unique_ptr<webapk::WebApk> request_proto,
                                   const GURL& server_url) {
   timer_.Start(
-      FROM_HERE,
-      base::TimeDelta::FromMilliseconds(webapk_download_url_timeout_ms_),
+      FROM_HERE, base::TimeDelta::FromMilliseconds(webapk_server_timeout_ms_),
       base::Bind(&WebApkInstaller::OnResult, weak_ptr_factory_.GetWeakPtr(),
                  WebApkInstallResult::FAILURE));
 
   url_fetcher_ =
       net::URLFetcher::Create(server_url, net::URLFetcher::POST, this);
   url_fetcher_->SetRequestContext(request_context_getter_);
   std::string serialized_request;
   request_proto->SerializeToString(&serialized_request);
   url_fetcher_->SetUploadData(kProtoMimeType, serialized_request);
   url_fetcher_->SetLoadFlags(
       net::LOAD_DISABLE_CACHE | net::LOAD_DO_NOT_SEND_COOKIES |
       net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_AUTH_DATA);
   url_fetcher_->Start();
 }
-
-void WebApkInstaller::OnGotWebApkDownloadUrl(const GURL& download_url,
-                                             const std::string& package_name) {
-  webapk_package_ = package_name;
-
-  base::PostTaskAndReplyWithResult(
-      GetBackgroundTaskRunner().get(), FROM_HERE,
-      base::Bind(&CreateSubDirAndSetPermissionsInBackground,
-                 task_type_ == WebApkInstaller::INSTALL ? "install" : "update",
-                 package_name),
-      base::Bind(&WebApkInstaller::OnCreatedSubDirAndSetPermissions,
-                 weak_ptr_factory_.GetWeakPtr(), download_url));
-}
-
-void WebApkInstaller::OnCreatedSubDirAndSetPermissions(
-    const GURL& download_url,
-    const base::FilePath& output_dir) {
-  if (output_dir.empty()) {
-    OnResult(WebApkInstallResult::FAILURE);
-    return;
-  }
-
-  DownloadWebApk(output_dir.AppendASCII(webapk_package_ + ".apk"), download_url,
-                 true);
-}
-
-void WebApkInstaller::DownloadWebApk(const base::FilePath& output_path,
-                                     const GURL& download_url,
-                                     bool retry_if_fails) {
-  timer_.Start(
-      FROM_HERE, base::TimeDelta::FromMilliseconds(download_timeout_ms_),
-      base::Bind(&WebApkInstaller::OnResult, weak_ptr_factory_.GetWeakPtr(),
-                 WebApkInstallResult::FAILURE));
-
-  downloader_.reset(new FileDownloader(
-      download_url, output_path, true, request_context_getter_,
-      base::Bind(&WebApkInstaller::OnWebApkDownloaded,
-                 weak_ptr_factory_.GetWeakPtr(), output_path, download_url,
-                 retry_if_fails),
-      NO_TRAFFIC_ANNOTATION_YET));
-}
-
-void WebApkInstaller::OnWebApkDownloaded(const base::FilePath& file_path,
-                                         const GURL& download_url,
-                                         bool retry_if_fails,
-                                         FileDownloader::Result result) {
-  timer_.Stop();
-
-  if (result != FileDownloader::DOWNLOADED) {
-    if (!retry_if_fails) {
-      OnResult(WebApkInstallResult::FAILURE);
-      return;
-    }
-
-    content::BrowserThread::PostDelayedTask(
-        content::BrowserThread::UI, FROM_HERE,
-        base::Bind(&WebApkInstaller::DownloadWebApk,
-                   weak_ptr_factory_.GetWeakPtr(), file_path, download_url,
-                   false),
-        base::TimeDelta::FromSeconds(2));
-    return;
-  }
-
-  int posix_permissions = kWorldReadableFilePermission |
-                          base::FILE_PERMISSION_WRITE_BY_USER |
-                          base::FILE_PERMISSION_EXECUTE_BY_USER;
-  base::PostTaskAndReplyWithResult(
-      GetBackgroundTaskRunner().get(), FROM_HERE,
-      base::Bind(&base::SetPosixFilePermissions, file_path, posix_permissions),
-      base::Bind(&WebApkInstaller::OnWebApkMadeWorldReadable,
-                 weak_ptr_factory_.GetWeakPtr(), file_path));
-}
-
-void WebApkInstaller::OnWebApkMadeWorldReadable(
-    const base::FilePath& file_path,
-    bool change_permission_success) {
-  if (!change_permission_success) {
-    OnResult(WebApkInstallResult::FAILURE);
-    return;
-  }
-
-  JNIEnv* env = base::android::AttachCurrentThread();
-  base::android::ScopedJavaLocalRef<jstring> java_file_path =
-      base::android::ConvertUTF8ToJavaString(env, file_path.value());
-  if (task_type_ == INSTALL) {
-    base::android::ScopedJavaLocalRef<jstring> java_package_name =
-        base::android::ConvertUTF8ToJavaString(env, webapk_package_);
-    InstallDownloadedWebApk(env, java_file_path, java_package_name);
-  } else if (task_type_ == UPDATE) {
-    UpdateUsingDownloadedWebApk(env, java_file_path);
-  }
-}