Routines in our upper file layers can't handle ".." or "symlinks" well (and a...

chrome/common/extensions/extension_resource.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/extension_resource.h"
 
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/string_util.h"
 #include "chrome/browser/extensions/extension_l10n_util.h"
@@ skipping 51 matching lines @@
   replacements.SetPathStr(new_path);
   GURL file_url = extension_url.ReplaceComponents(replacements);
   if (!file_url.is_valid())
     return FilePath();
 
   // Convert the result back to a FilePath.
   FilePath ret_val;
   if (!net::FileURLToFilePath(file_url, &ret_val))
     return FilePath();
 
+  // Converting the extension_url back to a path removes all .. and . references
+  // that may have been in extension_path that would cause isParent to break.
+  FilePath sanitized_extension_path;
+  if (!net::FileURLToFilePath(extension_url, &sanitized_extension_path))
+    return FilePath();
+
   // Double-check that the path we ended up with is actually inside the
   // extension root.
-  if (!extension_path.IsParent(ret_val))
+  if (!sanitized_extension_path.IsParent(ret_val))
     return FilePath();
 
   return ret_val;
 }
 
 // Unittesting helpers.
 FilePath::StringType ExtensionResource::NormalizeSeperators(
     FilePath::StringType path) const {
 #if defined(FILE_PATH_USES_WIN_SEPARATORS)
   FilePath::StringType ret_val;
   for (size_t i = 0; i < path.length(); i++) {
     if (FilePath::IsSeparator(path[i]))
       path[i] = FilePath::kSeparators[0];
   }
 #endif  // FILE_PATH_USES_WIN_SEPARATORS
   return path;
 }
 
 bool ExtensionResource::ComparePathWithDefault(const FilePath& path) const {
   if (NormalizeSeperators(path.value()) ==
     NormalizeSeperators(full_resource_path_.value())) {
     return true;
   } else {
     return false;
   }
 }