Mac Archive Type Sniffing

chrome/browser/safe_browsing/mac_archive_type_sniffer.h

Index: chrome/browser/safe_browsing/mac_archive_type_sniffer.h
diff --git a/chrome/browser/safe_browsing/mac_archive_type_sniffer.h b/chrome/browser/safe_browsing/mac_archive_type_sniffer.h
new file mode 100644
index 0000000000000000000000000000000000000000..6b40f538601128e9152bbf1096cdde1ef31eacc4
--- /dev/null
+++ b/chrome/browser/safe_browsing/mac_archive_type_sniffer.h
@@ -0,0 +1,40 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SAFE_BROWSING_MAC_ARCHIVE_TYPE_SNIFFER_H_
+#define CHROME_BROWSER_SAFE_BROWSING_MAC_ARCHIVE_TYPE_SNIFFER_H_
+
+#include "base/files/file.h"
+#include "base/files/file_path.h"
+#include "base/memory/ref_counted.h"
+#include "chrome/utility/safe_browsing/mac/convert_big_endian.h"
+#include "chrome/utility/safe_browsing/mac/dmg_iterator.h"
+#include "chrome/utility/safe_browsing/mac/read_stream.h"
+#include "chrome/utility/safe_browsing/mac/udif.h"
+
+namespace safe_browsing {
+
+// This class is used to determine whether a given file is a Mac archive type,
+// regardless of file extension. It does so by determining whether the file has
+// the 'koly' signature typical of Mac archive files.
+class MacArchiveTypeSniffer
+    : public base::RefCountedThreadSafe<MacArchiveTypeSniffer> {
+ public:
+  MacArchiveTypeSniffer();
+
+  // Reads trailer from file to see if it is a DMG type. Must be called on the
+  // FILE thread.
+  static bool IsAppleDiskImage(const base::FilePath& dmg_file);
+
+ private:
+  friend class base::RefCountedThreadSafe<MacArchiveTypeSniffer>;
+
+  ~MacArchiveTypeSniffer();
+
+  DISALLOW_COPY_AND_ASSIGN(MacArchiveTypeSniffer);
+};
+
+}  // namespace safe_browsing
+
+#endif  // CHROME_BROWSER_SAFE_BROWSING_MAC_ARCHIVE_TYPE_SNIFFER_H_