Mac Archive Type Sniffing

chrome/browser/safe_browsing/download_protection_service.cc

Index: chrome/browser/safe_browsing/download_protection_service.cc
diff --git a/chrome/browser/safe_browsing/download_protection_service.cc b/chrome/browser/safe_browsing/download_protection_service.cc
index 43d631ddca872ef8e4e38446a9c0f3458e6d582d..a49b93e26b02735f3952ba8f8412b8c614d9fb4d 100644
--- a/chrome/browser/safe_browsing/download_protection_service.cc
+++ b/chrome/browser/safe_browsing/download_protection_service.cc
@@ -74,6 +74,7 @@
 #include "net/url_request/url_request_status.h"
 
 #if defined(OS_MACOSX)
+#include "chrome/browser/safe_browsing/mac_archive_type_sniffer.h"
 #include "chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.h"
 #endif
 
@@ -471,7 +472,19 @@ class DownloadProtectionService::CheckClientDownloadRequest
       StartExtractDmgFeatures();
 #endif
     } else {
+#if defined(OS_MACOSX)
+      // Checks for existence of "koly" signature even if file doesn't have

[Jialiu Lin, 2017/06/09 20:24:18]

You also need to add unittest in download_protection_service_unittest.cc to
verify that a ClientDownloadReport is sent if a dmg pretends to be an other
type. 

The following function for your reference:
https://cs.chromium.org/chromium/src/chrome/browser/safe_browsing/download_pr...

[mortonm, 2017/06/09 22:47:25]

Ok, I have added the test. Currently I only check whether the
DownloadProtectionService determines that there is a valid archive in the
download file or not. Let me know if you think there is any more extensive
checking I should do.

+      // archive-type extension, then calls ExtractFileOrDmgFeatures() with
+      // result.
+      BrowserThread::PostTaskAndReplyWithResult(
+          BrowserThread::FILE, FROM_HERE,
+          base::Bind(MacArchiveTypeSniffer::IsAppleDiskImage,
+                     item_->GetTargetFilePath()),
+          base::Bind(&CheckClientDownloadRequest::ExtractFileOrDmgFeatures,
+                     this));
+#else
       StartExtractFileFeatures();
+#endif
     }
   }
 
@@ -779,6 +792,16 @@ class DownloadProtectionService::CheckClientDownloadRequest
     dmg_analysis_start_time_ = base::TimeTicks::Now();
   }
 
+  // Extracts DMG features if file has 'koly' signature, otherwise extracts
+  // regular file features.
+  void ExtractFileOrDmgFeatures(bool download_file_has_koly_signature) {
+    DCHECK_CURRENTLY_ON(BrowserThread::UI);
+    if (download_file_has_koly_signature)
+      StartExtractDmgFeatures();
+    else
+      StartExtractFileFeatures();
+  }
+
   void OnDmgAnalysisFinished(const ArchiveAnalyzerResults& results) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
     DCHECK_EQ(ClientDownloadRequest::MAC_EXECUTABLE, type_);