Experimentally isolate OpenItemViaShell in a utility process.

chrome/utility/shell_handler_win.cc

 // Copyright (c) 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/utility/shell_handler_win.h"
 
 #include <commdlg.h>
 
 #include "base/files/file_path.h"
 #include "base/memory/scoped_ptr.h"
 #include "chrome/common/chrome_utility_messages.h"
 #include "content/public/utility/utility_thread.h"
 #include "ui/base/win/open_file_name_win.h"
+#include "ui/base/win/shell.h"
 
 ShellHandler::ShellHandler() {}
 ShellHandler::~ShellHandler() {}
 
 bool ShellHandler::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(ShellHandler, message)
+    IPC_MESSAGE_HANDLER(ChromeUtilityMsg_OpenItemViaShell,
+                        OnOpenItemViaShell)
     IPC_MESSAGE_HANDLER(ChromeUtilityMsg_GetOpenFileName,
                         OnGetOpenFileName)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
+void ShellHandler::OnOpenItemViaShell(const base::FilePath& full_path) {
+  ui::win::OpenItemViaShell(full_path);

[palmer, 2014/08/12 21:23:57]

Is |full_path| tested for sanity, quoted, or transformed in any way? It doesn't
seem to happen in |ui::win::OpenItemViaShell| or its callee, |OpenAnyViaShell|.
Are those functions expecting their caller to sanitize the arguments first? Or
is the utility process sandboxed such that it is guaranteed not to cause any
trouble?

[erikwright (departed), 2014/08/13 17:27:13]

The utility process is not sandboxed. It is invoking a function that was
previously executed in the browser process. By putting it in a separate process
we protect the browser from 3rd-party modules that certain shell functions can
cause to be loaded into the client process. But this IPC handler is intended to
open whatever file is passed to it, in exactly the same way that its client (the
browser process) could have done.

I'm not sure what kind of sanitization would be required or possible. Presumably
a sandboxed process cannot invoke an unsandboxed utility process.

The FilePath IPC parameter is apparently serialized/deserialized as a string via
Pickle. If we are able to successfully read a string, there is not really any
other sanity check I can perform.

+}
+
 void ShellHandler::OnGetOpenFileName(
     HWND owner,
     DWORD flags,
     const GetOpenFileNameFilter& filter,
     const base::FilePath& initial_directory,
     const base::FilePath& filename) {
   ui::win::OpenFileName open_file_name(owner, flags);
   open_file_name.SetInitialSelection(initial_directory, filename);
   open_file_name.SetFilters(filter);
 
   base::FilePath directory;
   std::vector<base::FilePath> filenames;
 
   if (::GetOpenFileName(open_file_name.GetOPENFILENAME()))
     open_file_name.GetResult(&directory, &filenames);
 
   if (filenames.size()) {
     content::UtilityThread::Get()->Send(
         new ChromeUtilityHostMsg_GetOpenFileName_Result(directory, filenames));
   } else {
     content::UtilityThread::Get()->Send(
         new ChromeUtilityHostMsg_GetOpenFileName_Failed());
   }
 }