Experimentally isolate OpenItemViaShell in a utility process.

chrome/utility/shell_handler_win.cc

Index: chrome/utility/shell_handler_win.cc
diff --git a/chrome/utility/shell_handler_win.cc b/chrome/utility/shell_handler_win.cc
index 2f413c0fe813a79e231f38c15cedd0b955b443f5..06a7e3e1d90bd41929ee50ca5b2c259205d6afb2 100644
--- a/chrome/utility/shell_handler_win.cc
+++ b/chrome/utility/shell_handler_win.cc
@@ -11,6 +11,7 @@
 #include "chrome/common/chrome_utility_messages.h"
 #include "content/public/utility/utility_thread.h"
 #include "ui/base/win/open_file_name_win.h"
+#include "ui/base/win/shell.h"
 
 ShellHandler::ShellHandler() {}
 ShellHandler::~ShellHandler() {}
@@ -18,6 +19,8 @@ ShellHandler::~ShellHandler() {}
 bool ShellHandler::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(ShellHandler, message)
+    IPC_MESSAGE_HANDLER(ChromeUtilityMsg_OpenItemViaShell,
+                        OnOpenItemViaShell)
     IPC_MESSAGE_HANDLER(ChromeUtilityMsg_GetOpenFileName,
                         OnGetOpenFileName)
     IPC_MESSAGE_UNHANDLED(handled = false)
@@ -25,6 +28,10 @@ bool ShellHandler::OnMessageReceived(const IPC::Message& message) {
   return handled;
 }
 
+void ShellHandler::OnOpenItemViaShell(const base::FilePath& full_path) {
+  ui::win::OpenItemViaShell(full_path);

[palmer, 2014/08/12 21:23:57]

Is |full_path| tested for sanity, quoted, or transformed in any way? It doesn't
seem to happen in |ui::win::OpenItemViaShell| or its callee, |OpenAnyViaShell|.
Are those functions expecting their caller to sanitize the arguments first? Or
is the utility process sandboxed such that it is guaranteed not to cause any
trouble?

[erikwright (departed), 2014/08/13 17:27:13]

The utility process is not sandboxed. It is invoking a function that was
previously executed in the browser process. By putting it in a separate process
we protect the browser from 3rd-party modules that certain shell functions can
cause to be loaded into the client process. But this IPC handler is intended to
open whatever file is passed to it, in exactly the same way that its client (the
browser process) could have done.

I'm not sure what kind of sanitization would be required or possible. Presumably
a sandboxed process cannot invoke an unsandboxed utility process.

The FilePath IPC parameter is apparently serialized/deserialized as a string via
Pickle. If we are able to successfully read a string, there is not really any
other sanity check I can perform.

+}
+
 void ShellHandler::OnGetOpenFileName(
     HWND owner,
     DWORD flags,