Record Code Signature of Downloaded DMG files

chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.h"
 
 #include <mach-o/loader.h>
 #include <stdint.h>
 
 #include "base/bind.h"
 #include "base/files/file_path.h"
+#include "base/files/file_util.h"
 #include "base/macros.h"
 #include "base/path_service.h"
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/safe_browsing/archive_analyzer_results.h"
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "content/public/test/test_utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ skipping 112 matching lines @@
           actual_sha256);
     } else {
       ADD_FAILURE() << "Unepxected result file " << binary.file_basename();
     }
   }
 
   EXPECT_TRUE(got_executable);
   EXPECT_TRUE(got_dylib);
 }
 
+TEST_F(SandboxedDMGAnalyzerTest, AnalyzeDmgNoSignature) {
+  base::FilePath unsigned_dmg;
+  ASSERT_NO_FATAL_FAILURE(unsigned_dmg = GetFilePath("mach_o_in_dmg.dmg"));
+
+  ArchiveAnalyzerResults results;
+  AnalyzeFile(unsigned_dmg, &results);
+
+  EXPECT_TRUE(results.success);
+  EXPECT_EQ((uint64_t)0, results.signature_blob.size());

[Robert Sesek, 2017/06/28 18:21:06]

Same, just use a 'u' suffix.

[mortonm, 2017/06/28 23:07:08]

Done.

+  EXPECT_EQ(nullptr, results.signature_blob.data());
+}
+
+TEST_F(SandboxedDMGAnalyzerTest, AnalyzeDmgWithSignature) {
+  base::FilePath signed_dmg;
+  EXPECT_TRUE(PathService::Get(chrome::DIR_TEST_DATA, &signed_dmg));
+  signed_dmg = signed_dmg.AppendASCII("safe_browsing")
+                   .AppendASCII("download_protection")
+                   .AppendASCII("googlechrome.dmg");
+
+  ArchiveAnalyzerResults results;
+  AnalyzeFile(signed_dmg, &results);
+
+  EXPECT_TRUE(results.success);
+  EXPECT_EQ((uint64_t)9454, results.signature_blob.size());

[Robert Sesek, 2017/06/28 18:21:06]

Same.

[mortonm, 2017/06/28 23:07:08]

Done.

+
+  base::FilePath signed_dmg_signature;
+  EXPECT_TRUE(PathService::Get(chrome::DIR_TEST_DATA, &signed_dmg_signature));
+  signed_dmg_signature = signed_dmg_signature.AppendASCII("safe_browsing")
+                             .AppendASCII("download_protection")
+                             .AppendASCII("googlechrome_signature.data");
+
+  std::string from_file;
+  base::ReadFileToString(signed_dmg_signature, &from_file);
+  EXPECT_EQ((uint64_t)9454, from_file.length());

[Robert Sesek, 2017/06/28 18:21:06]

Same.

[mortonm, 2017/06/28 23:07:08]

Done.

+  std::string signature(results.signature_blob.begin(),
+                        results.signature_blob.end());
+  EXPECT_EQ(from_file, signature);
+}
+
 }  // namespace
 }  // namespace safe_browsing