Mac Archive Type Sniffing

chrome/browser/safe_browsing/download_protection_service.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/safe_browsing/download_protection_service.h"
 
 #include <stddef.h>
 
 #include <memory>
 
@@ skipping 56 matching lines @@
 #include "net/base/url_util.h"
 #include "net/cert/x509_cert_types.h"
 #include "net/cert/x509_certificate.h"
 #include "net/http/http_status_code.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_fetcher_delegate.h"
 #include "net/url_request/url_request_status.h"
 
 #if defined(OS_MACOSX)
+#include "chrome/browser/safe_browsing/mac_archive_type_sniffer.h"
 #include "chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.h"
 #endif
 
 using content::BrowserThread;
 namespace safe_browsing {
 
 namespace {
 
 const int64_t kDownloadRequestTimeoutMs = 7000;
 // We sample 1% of whitelisted downloads to still send out download pings.
@@ skipping 377 matching lines @@
                    FILE_PATH_LITERAL(".sparsebundle")) ||
                item_->GetTargetFilePath().MatchesExtension(
                    FILE_PATH_LITERAL(".sparseimage")) ||
                item_->GetTargetFilePath().MatchesExtension(
                    FILE_PATH_LITERAL(".toast")) ||
                item_->GetTargetFilePath().MatchesExtension(
                    FILE_PATH_LITERAL(".udif"))) {
       StartExtractDmgFeatures();
 #endif
     } else {
+#if defined(OS_MACOSX)
+      // Checks for existence of "koly" signature even if file doesn't have

[Jialiu Lin, 2017/06/09 20:24:18]

You also need to add unittest in download_protection_service_unittest.cc to
verify that a ClientDownloadReport is sent if a dmg pretends to be an other
type. 

The following function for your reference:
https://cs.chromium.org/chromium/src/chrome/browser/safe_browsing/download_pr...

[mortonm, 2017/06/09 22:47:25]

Ok, I have added the test. Currently I only check whether the
DownloadProtectionService determines that there is a valid archive in the
download file or not. Let me know if you think there is any more extensive
checking I should do.

+      // archive-type extension, then calls ExtractFileOrDmgFeatures() with
+      // result.
+      BrowserThread::PostTaskAndReplyWithResult(
+          BrowserThread::FILE, FROM_HERE,
+          base::Bind(MacArchiveTypeSniffer::IsAppleDiskImage,
+                     item_->GetTargetFilePath()),
+          base::Bind(&CheckClientDownloadRequest::ExtractFileOrDmgFeatures,
+                     this));
+#else
       StartExtractFileFeatures();
+#endif
     }
   }
 
   // Start a timeout to cancel the request if it takes too long.
   // This should only be called after we have finished accessing the file.
   void StartTimeout() {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
     if (!service_) {
       // Request has already been cancelled.
       return;
@@ skipping 287 matching lines @@
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
     DCHECK(item_);
     dmg_analyzer_ = new SandboxedDMGAnalyzer(
         item_->GetFullPath(),
         base::Bind(&CheckClientDownloadRequest::OnDmgAnalysisFinished,
                    weakptr_factory_.GetWeakPtr()));
     dmg_analyzer_->Start();
     dmg_analysis_start_time_ = base::TimeTicks::Now();
   }
 
+  // Extracts DMG features if file has 'koly' signature, otherwise extracts
+  // regular file features.
+  void ExtractFileOrDmgFeatures(bool download_file_has_koly_signature) {
+    DCHECK_CURRENTLY_ON(BrowserThread::UI);
+    if (download_file_has_koly_signature)
+      StartExtractDmgFeatures();
+    else
+      StartExtractFileFeatures();
+  }
+
   void OnDmgAnalysisFinished(const ArchiveAnalyzerResults& results) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
     DCHECK_EQ(ClientDownloadRequest::MAC_EXECUTABLE, type_);
     if (!service_)
       return;
 
     // Even if !results.success, some of the DMG may have been parsed.
     archive_is_valid_ =
         (results.success ? ArchiveValid::VALID : ArchiveValid::INVALID);
     archived_executable_ = results.has_executable;
@@ skipping 1199 matching lines @@
           out_request->mutable_referrer_chain());
   UMA_HISTOGRAM_COUNTS_100(
       "SafeBrowsing.ReferrerURLChainSize.PPAPIDownloadAttribution",
       out_request->referrer_chain_size());
   UMA_HISTOGRAM_ENUMERATION(
       "SafeBrowsing.ReferrerAttributionResult.PPAPIDownloadAttribution", result,
       SafeBrowsingNavigationObserverManager::ATTRIBUTION_FAILURE_TYPE_MAX);
 }
 
 }  // namespace safe_browsing