| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #ifndef CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_ | |
| 6 #define CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_ | |
| 7 | |
| 8 #include <string> | |
| 9 | |
| 10 #include "base/files/file_path.h" | |
| 11 #include "base/files/scoped_temp_dir.h" | |
| 12 #include "base/memory/ref_counted.h" | |
| 13 #include "base/time/time.h" | |
| 14 #include "content/public/browser/utility_process_host_client.h" | |
| 15 #include "extensions/common/manifest.h" | |
| 16 | |
| 17 class SkBitmap; | |
| 18 | |
| 19 namespace base { | |
| 20 class DictionaryValue; | |
| 21 class SequencedTaskRunner; | |
| 22 } | |
| 23 | |
| 24 namespace extensions { | |
| 25 class Extension; | |
| 26 | |
| 27 class SandboxedUnpackerClient | |
| 28 : public base::RefCountedThreadSafe<SandboxedUnpackerClient> { | |
| 29 public: | |
| 30 // temp_dir - A temporary directory containing the results of the extension | |
| 31 // unpacking. The client is responsible for deleting this directory. | |
| 32 // | |
| 33 // extension_root - The path to the extension root inside of temp_dir. | |
| 34 // | |
| 35 // original_manifest - The parsed but unmodified version of the manifest, | |
| 36 // with no modifications such as localization, etc. | |
| 37 // | |
| 38 // extension - The extension that was unpacked. The client is responsible | |
| 39 // for deleting this memory. | |
| 40 // | |
| 41 // install_icon - The icon we will display in the installation UI, if any. | |
| 42 virtual void OnUnpackSuccess(const base::FilePath& temp_dir, | |
| 43 const base::FilePath& extension_root, | |
| 44 const base::DictionaryValue* original_manifest, | |
| 45 const Extension* extension, | |
| 46 const SkBitmap& install_icon) = 0; | |
| 47 virtual void OnUnpackFailure(const base::string16& error) = 0; | |
| 48 | |
| 49 protected: | |
| 50 friend class base::RefCountedThreadSafe<SandboxedUnpackerClient>; | |
| 51 | |
| 52 virtual ~SandboxedUnpackerClient() {} | |
| 53 }; | |
| 54 | |
| 55 // SandboxedUnpacker unpacks extensions from the CRX format into a | |
| 56 // directory. This is done in a sandboxed subprocess to protect the browser | |
| 57 // process from parsing complex formats like JPEG or JSON from untrusted | |
| 58 // sources. | |
| 59 // | |
| 60 // Unpacking an extension using this class makes minor changes to its source, | |
| 61 // such as transcoding all images to PNG, parsing all message catalogs | |
| 62 // and rewriting the manifest JSON. As such, it should not be used when the | |
| 63 // output is not intended to be given back to the author. | |
| 64 // | |
| 65 // | |
| 66 // Lifetime management: | |
| 67 // | |
| 68 // This class is ref-counted by each call it makes to itself on another thread, | |
| 69 // and by UtilityProcessHost. | |
| 70 // | |
| 71 // Additionally, we hold a reference to our own client so that it lives at least | |
| 72 // long enough to receive the result of unpacking. | |
| 73 // | |
| 74 // | |
| 75 // NOTE: This class should only be used on the file thread. | |
| 76 class SandboxedUnpacker : public content::UtilityProcessHostClient { | |
| 77 public: | |
| 78 // Unpacks the extension in |crx_path| into a temporary directory and calls | |
| 79 // |client| with the result. If |run_out_of_process| is provided, unpacking | |
| 80 // is done in a sandboxed subprocess. Otherwise, it is done in-process. | |
| 81 SandboxedUnpacker( | |
| 82 const base::FilePath& crx_path, | |
| 83 Manifest::Location location, | |
| 84 int creation_flags, | |
| 85 const base::FilePath& extensions_dir, | |
| 86 const scoped_refptr<base::SequencedTaskRunner>& unpacker_io_task_runner, | |
| 87 SandboxedUnpackerClient* client); | |
| 88 | |
| 89 // Start unpacking the extension. The client is called with the results. | |
| 90 void Start(); | |
| 91 | |
| 92 private: | |
| 93 class ProcessHostClient; | |
| 94 | |
| 95 // Enumerate all the ways unpacking can fail. Calls to ReportFailure() | |
| 96 // take a failure reason as an argument, and put it in histogram | |
| 97 // Extensions.SandboxUnpackFailureReason. | |
| 98 enum FailureReason { | |
| 99 // SandboxedUnpacker::CreateTempDirectory() | |
| 100 COULD_NOT_GET_TEMP_DIRECTORY, | |
| 101 COULD_NOT_CREATE_TEMP_DIRECTORY, | |
| 102 | |
| 103 // SandboxedUnpacker::Start() | |
| 104 FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY, | |
| 105 COULD_NOT_GET_SANDBOX_FRIENDLY_PATH, | |
| 106 | |
| 107 // SandboxedUnpacker::OnUnpackExtensionSucceeded() | |
| 108 COULD_NOT_LOCALIZE_EXTENSION, | |
| 109 INVALID_MANIFEST, | |
| 110 | |
| 111 // SandboxedUnpacker::OnUnpackExtensionFailed() | |
| 112 UNPACKER_CLIENT_FAILED, | |
| 113 | |
| 114 // SandboxedUnpacker::OnProcessCrashed() | |
| 115 UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL, | |
| 116 | |
| 117 // SandboxedUnpacker::ValidateSignature() | |
| 118 CRX_FILE_NOT_READABLE, | |
| 119 CRX_HEADER_INVALID, | |
| 120 CRX_MAGIC_NUMBER_INVALID, | |
| 121 CRX_VERSION_NUMBER_INVALID, | |
| 122 CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE, | |
| 123 CRX_ZERO_KEY_LENGTH, | |
| 124 CRX_ZERO_SIGNATURE_LENGTH, | |
| 125 CRX_PUBLIC_KEY_INVALID, | |
| 126 CRX_SIGNATURE_INVALID, | |
| 127 CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED, | |
| 128 CRX_SIGNATURE_VERIFICATION_FAILED, | |
| 129 | |
| 130 // SandboxedUnpacker::RewriteManifestFile() | |
| 131 ERROR_SERIALIZING_MANIFEST_JSON, | |
| 132 ERROR_SAVING_MANIFEST_JSON, | |
| 133 | |
| 134 // SandboxedUnpacker::RewriteImageFiles() | |
| 135 COULD_NOT_READ_IMAGE_DATA_FROM_DISK, | |
| 136 DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST, | |
| 137 INVALID_PATH_FOR_BROWSER_IMAGE, | |
| 138 ERROR_REMOVING_OLD_IMAGE_FILE, | |
| 139 INVALID_PATH_FOR_BITMAP_IMAGE, | |
| 140 ERROR_RE_ENCODING_THEME_IMAGE, | |
| 141 ERROR_SAVING_THEME_IMAGE, | |
| 142 ABORTED_DUE_TO_SHUTDOWN, | |
| 143 | |
| 144 // SandboxedUnpacker::RewriteCatalogFiles() | |
| 145 COULD_NOT_READ_CATALOG_DATA_FROM_DISK, | |
| 146 INVALID_CATALOG_DATA, | |
| 147 INVALID_PATH_FOR_CATALOG, | |
| 148 ERROR_SERIALIZING_CATALOG, | |
| 149 ERROR_SAVING_CATALOG, | |
| 150 | |
| 151 NUM_FAILURE_REASONS | |
| 152 }; | |
| 153 | |
| 154 friend class ProcessHostClient; | |
| 155 friend class SandboxedUnpackerTest; | |
| 156 | |
| 157 ~SandboxedUnpacker() override; | |
| 158 | |
| 159 // Set |temp_dir_| as a temporary directory to unpack the extension in. | |
| 160 // Return true on success. | |
| 161 virtual bool CreateTempDirectory(); | |
| 162 | |
| 163 // Validates the signature of the extension and extract the key to | |
| 164 // |public_key_|. Returns true if the signature validates, false otherwise. | |
| 165 // | |
| 166 // NOTE: Having this method here is a bit ugly. This code should really live | |
| 167 // in extensions::Unpacker as it is not specific to sandboxed unpacking. It | |
| 168 // was put here because we cannot run windows crypto code in the sandbox. But | |
| 169 // we could still have this method statically on extensions::Unpacker so that | |
| 170 // code just for unpacking is there and code just for sandboxing of unpacking | |
| 171 // is here. | |
| 172 bool ValidateSignature(); | |
| 173 | |
| 174 // Starts the utility process that unpacks our extension. | |
| 175 void StartProcessOnIOThread(const base::FilePath& temp_crx_path); | |
| 176 | |
| 177 // UtilityProcessHostClient | |
| 178 bool OnMessageReceived(const IPC::Message& message) override; | |
| 179 void OnProcessCrashed(int exit_code) override; | |
| 180 | |
| 181 // IPC message handlers. | |
| 182 void OnUnpackExtensionSucceeded(const base::DictionaryValue& manifest); | |
| 183 void OnUnpackExtensionFailed(const base::string16& error_message); | |
| 184 | |
| 185 void ReportFailure(FailureReason reason, const base::string16& message); | |
| 186 void ReportSuccess(const base::DictionaryValue& original_manifest, | |
| 187 const SkBitmap& install_icon); | |
| 188 | |
| 189 // Overwrites original manifest with safe result from utility process. | |
| 190 // Returns NULL on error. Caller owns the returned object. | |
| 191 base::DictionaryValue* RewriteManifestFile( | |
| 192 const base::DictionaryValue& manifest); | |
| 193 | |
| 194 // Overwrites original files with safe results from utility process. | |
| 195 // Reports error and returns false if it fails. | |
| 196 bool RewriteImageFiles(SkBitmap* install_icon); | |
| 197 bool RewriteCatalogFiles(); | |
| 198 | |
| 199 // Cleans up temp directory artifacts. | |
| 200 void Cleanup(); | |
| 201 | |
| 202 // The path to the CRX to unpack. | |
| 203 base::FilePath crx_path_; | |
| 204 | |
| 205 // Our client. | |
| 206 scoped_refptr<SandboxedUnpackerClient> client_; | |
| 207 | |
| 208 // The Extensions directory inside the profile. | |
| 209 base::FilePath extensions_dir_; | |
| 210 | |
| 211 // A temporary directory to use for unpacking. | |
| 212 base::ScopedTempDir temp_dir_; | |
| 213 | |
| 214 // The root directory of the unpacked extension. This is a child of temp_dir_. | |
| 215 base::FilePath extension_root_; | |
| 216 | |
| 217 // Represents the extension we're unpacking. | |
| 218 scoped_refptr<Extension> extension_; | |
| 219 | |
| 220 // Whether we've received a response from the utility process yet. | |
| 221 bool got_response_; | |
| 222 | |
| 223 // The public key that was extracted from the CRX header. | |
| 224 std::string public_key_; | |
| 225 | |
| 226 // The extension's ID. This will be calculated from the public key in the crx | |
| 227 // header. | |
| 228 std::string extension_id_; | |
| 229 | |
| 230 // Time at which unpacking started. Used to compute the time unpacking takes. | |
| 231 base::TimeTicks unpack_start_time_; | |
| 232 | |
| 233 // Location to use for the unpacked extension. | |
| 234 Manifest::Location location_; | |
| 235 | |
| 236 // Creation flags to use for the extension. These flags will be used | |
| 237 // when calling Extenion::Create() by the crx installer. | |
| 238 int creation_flags_; | |
| 239 | |
| 240 // Sequenced task runner where file I/O operations will be performed at. | |
| 241 scoped_refptr<base::SequencedTaskRunner> unpacker_io_task_runner_; | |
| 242 }; | |
| 243 | |
| 244 } // namespace extensions | |
| 245 | |
| 246 #endif // CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_ | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 864093002:
Move sandboxed_unpacker.{h,cc} from chrome/ to extensions/ (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master