| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "net/base/filename_util.h" | |
| 6 | |
| 7 #include "base/files/file_path.h" | |
| 8 #include "base/files/file_util.h" | |
| 9 #include "base/strings/string_util.h" | |
| 10 #include "base/strings/sys_string_conversions.h" | |
| 11 #include "base/strings/utf_string_conversions.h" | |
| 12 #include "base/threading/thread_restrictions.h" | |
| 13 #include "net/base/escape.h" | |
| 14 #include "net/base/filename_util_internal.h" | |
| 15 #include "net/base/mime_util.h" | |
| 16 #include "net/base/net_string_util.h" | |
| 17 #include "net/http/http_content_disposition.h" | |
| 18 #include "url/gurl.h" | |
| 19 | |
| 20 namespace net { | |
| 21 | |
| 22 void SanitizeGeneratedFileName(base::FilePath::StringType* filename, | |
| 23 bool replace_trailing) { | |
| 24 const base::FilePath::CharType kReplace[] = FILE_PATH_LITERAL("-"); | |
| 25 if (filename->empty()) | |
| 26 return; | |
| 27 if (replace_trailing) { | |
| 28 // Handle CreateFile() stripping trailing dots and spaces on filenames | |
| 29 // http://support.microsoft.com/kb/115827 | |
| 30 size_t length = filename->size(); | |
| 31 size_t pos = filename->find_last_not_of(FILE_PATH_LITERAL(" .")); | |
| 32 filename->resize((pos == std::string::npos) ? 0 : (pos + 1)); | |
| 33 base::TrimWhitespace(*filename, base::TRIM_TRAILING, filename); | |
| 34 if (filename->empty()) | |
| 35 return; | |
| 36 size_t trimmed = length - filename->size(); | |
| 37 if (trimmed) | |
| 38 filename->insert(filename->end(), trimmed, kReplace[0]); | |
| 39 } | |
| 40 base::TrimString(*filename, FILE_PATH_LITERAL("."), filename); | |
| 41 if (filename->empty()) | |
| 42 return; | |
| 43 // Replace any path information by changing path separators. | |
| 44 ReplaceSubstringsAfterOffset(filename, 0, FILE_PATH_LITERAL("/"), kReplace); | |
| 45 ReplaceSubstringsAfterOffset(filename, 0, FILE_PATH_LITERAL("\\"), kReplace); | |
| 46 } | |
| 47 | |
| 48 // Returns the filename determined from the last component of the path portion | |
| 49 // of the URL. Returns an empty string if the URL doesn't have a path or is | |
| 50 // invalid. If the generated filename is not reliable, | |
| 51 // |should_overwrite_extension| will be set to true, in which case a better | |
| 52 // extension should be determined based on the content type. | |
| 53 std::string GetFileNameFromURL(const GURL& url, | |
| 54 const std::string& referrer_charset, | |
| 55 bool* should_overwrite_extension) { | |
| 56 // about: and data: URLs don't have file names, but esp. data: URLs may | |
| 57 // contain parts that look like ones (i.e., contain a slash). Therefore we | |
| 58 // don't attempt to divine a file name out of them. | |
| 59 if (!url.is_valid() || url.SchemeIs("about") || url.SchemeIs("data")) | |
| 60 return std::string(); | |
| 61 | |
| 62 const std::string unescaped_url_filename = UnescapeURLComponent( | |
| 63 url.ExtractFileName(), | |
| 64 UnescapeRule::SPACES | UnescapeRule::URL_SPECIAL_CHARS); | |
| 65 | |
| 66 // The URL's path should be escaped UTF-8, but may not be. | |
| 67 std::string decoded_filename = unescaped_url_filename; | |
| 68 if (!base::IsStringUTF8(decoded_filename)) { | |
| 69 // TODO(jshin): this is probably not robust enough. To be sure, we need | |
| 70 // encoding detection. | |
| 71 base::string16 utf16_output; | |
| 72 if (!referrer_charset.empty() && | |
| 73 net::ConvertToUTF16( | |
| 74 unescaped_url_filename, referrer_charset.c_str(), &utf16_output)) { | |
| 75 decoded_filename = base::UTF16ToUTF8(utf16_output); | |
| 76 } else { | |
| 77 decoded_filename = | |
| 78 base::WideToUTF8(base::SysNativeMBToWide(unescaped_url_filename)); | |
| 79 } | |
| 80 } | |
| 81 // If the URL contains a (possibly empty) query, assume it is a generator, and | |
| 82 // allow the determined extension to be overwritten. | |
| 83 *should_overwrite_extension = !decoded_filename.empty() && url.has_query(); | |
| 84 | |
| 85 return decoded_filename; | |
| 86 } | |
| 87 | |
| 88 // Returns whether the specified extension is automatically integrated into the | |
| 89 // windows shell. | |
| 90 bool IsShellIntegratedExtension(const base::FilePath::StringType& extension) { | |
| 91 base::FilePath::StringType extension_lower = | |
| 92 base::StringToLowerASCII(extension); | |
| 93 | |
| 94 // http://msdn.microsoft.com/en-us/library/ms811694.aspx | |
| 95 // Right-clicking on shortcuts can be magical. | |
| 96 if ((extension_lower == FILE_PATH_LITERAL("local")) || | |
| 97 (extension_lower == FILE_PATH_LITERAL("lnk"))) | |
| 98 return true; | |
| 99 | |
| 100 // http://www.juniper.net/security/auto/vulnerabilities/vuln2612.html | |
| 101 // Files become magical if they end in a CLSID, so block such extensions. | |
| 102 if (!extension_lower.empty() && | |
| 103 (extension_lower[0] == FILE_PATH_LITERAL('{')) && | |
| 104 (extension_lower[extension_lower.length() - 1] == FILE_PATH_LITERAL('}'))) | |
| 105 return true; | |
| 106 return false; | |
| 107 } | |
| 108 | |
| 109 // Returns whether the specified file name is a reserved name on windows. | |
| 110 // This includes names like "com2.zip" (which correspond to devices) and | |
| 111 // desktop.ini and thumbs.db which have special meaning to the windows shell. | |
| 112 bool IsReservedName(const base::FilePath::StringType& filename) { | |
| 113 // This list is taken from the MSDN article "Naming a file" | |
| 114 // http://msdn2.microsoft.com/en-us/library/aa365247(VS.85).aspx | |
| 115 // I also added clock$ because GetSaveFileName seems to consider it as a | |
| 116 // reserved name too. | |
| 117 static const char* const known_devices[] = { | |
| 118 "con", "prn", "aux", "nul", "com1", "com2", "com3", "com4", | |
| 119 "com5", "com6", "com7", "com8", "com9", "lpt1", "lpt2", "lpt3", | |
| 120 "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9", "clock$"}; | |
| 121 #if defined(OS_WIN) | |
| 122 std::string filename_lower = | |
| 123 base::StringToLowerASCII(base::WideToUTF8(filename)); | |
| 124 #elif defined(OS_POSIX) | |
| 125 std::string filename_lower = base::StringToLowerASCII(filename); | |
| 126 #endif | |
| 127 | |
| 128 for (size_t i = 0; i < arraysize(known_devices); ++i) { | |
| 129 // Exact match. | |
| 130 if (filename_lower == known_devices[i]) | |
| 131 return true; | |
| 132 // Starts with "DEVICE.". | |
| 133 if (filename_lower.find(std::string(known_devices[i]) + ".") == 0) | |
| 134 return true; | |
| 135 } | |
| 136 | |
| 137 static const char* const magic_names[] = { | |
| 138 // These file names are used by the "Customize folder" feature of the shell. | |
| 139 "desktop.ini", | |
| 140 "thumbs.db", | |
| 141 }; | |
| 142 | |
| 143 for (size_t i = 0; i < arraysize(magic_names); ++i) { | |
| 144 if (filename_lower == magic_names[i]) | |
| 145 return true; | |
| 146 } | |
| 147 | |
| 148 return false; | |
| 149 } | |
| 150 | |
| 151 // Examines the current extension in |file_name| and modifies it if necessary in | |
| 152 // order to ensure the filename is safe. If |file_name| doesn't contain an | |
| 153 // extension or if |ignore_extension| is true, then a new extension will be | |
| 154 // constructed based on the |mime_type|. | |
| 155 // | |
| 156 // We're addressing two things here: | |
| 157 // | |
| 158 // 1) Usability. If there is no reliable file extension, we want to guess a | |
| 159 // reasonable file extension based on the content type. | |
| 160 // | |
| 161 // 2) Shell integration. Some file extensions automatically integrate with the | |
| 162 // shell. We block these extensions to prevent a malicious web site from | |
| 163 // integrating with the user's shell. | |
| 164 void EnsureSafeExtension(const std::string& mime_type, | |
| 165 bool ignore_extension, | |
| 166 base::FilePath* file_name) { | |
| 167 // See if our file name already contains an extension. | |
| 168 base::FilePath::StringType extension = file_name->Extension(); | |
| 169 if (!extension.empty()) | |
| 170 extension.erase(extension.begin()); // Erase preceding '.'. | |
| 171 | |
| 172 if ((ignore_extension || extension.empty()) && !mime_type.empty()) { | |
| 173 base::FilePath::StringType preferred_mime_extension; | |
| 174 std::vector<base::FilePath::StringType> all_mime_extensions; | |
| 175 net::GetPreferredExtensionForMimeType(mime_type, &preferred_mime_extension); | |
| 176 net::GetExtensionsForMimeType(mime_type, &all_mime_extensions); | |
| 177 // If the existing extension is in the list of valid extensions for the | |
| 178 // given type, use it. This avoids doing things like pointlessly renaming | |
| 179 // "foo.jpg" to "foo.jpeg". | |
| 180 if (std::find(all_mime_extensions.begin(), | |
| 181 all_mime_extensions.end(), | |
| 182 extension) != all_mime_extensions.end()) { | |
| 183 // leave |extension| alone | |
| 184 } else if (!preferred_mime_extension.empty()) { | |
| 185 extension = preferred_mime_extension; | |
| 186 } | |
| 187 } | |
| 188 | |
| 189 #if defined(OS_WIN) | |
| 190 static const base::FilePath::CharType default_extension[] = | |
| 191 FILE_PATH_LITERAL("download"); | |
| 192 | |
| 193 // Rename shell-integrated extensions. | |
| 194 // TODO(asanka): Consider stripping out the bad extension and replacing it | |
| 195 // with the preferred extension for the MIME type if one is available. | |
| 196 if (IsShellIntegratedExtension(extension)) | |
| 197 extension.assign(default_extension); | |
| 198 #endif | |
| 199 | |
| 200 *file_name = file_name->ReplaceExtension(extension); | |
| 201 } | |
| 202 | |
| 203 bool FilePathToString16(const base::FilePath& path, base::string16* converted) { | |
| 204 #if defined(OS_WIN) | |
| 205 *converted = path.value(); | |
| 206 return true; | |
| 207 #elif defined(OS_POSIX) | |
| 208 std::string component8 = path.AsUTF8Unsafe(); | |
| 209 return !component8.empty() && | |
| 210 base::UTF8ToUTF16(component8.c_str(), component8.size(), converted); | |
| 211 #endif | |
| 212 } | |
| 213 | |
| 214 base::string16 GetSuggestedFilenameImpl( | |
| 215 const GURL& url, | |
| 216 const std::string& content_disposition, | |
| 217 const std::string& referrer_charset, | |
| 218 const std::string& suggested_name, | |
| 219 const std::string& mime_type, | |
| 220 const std::string& default_name, | |
| 221 ReplaceIllegalCharactersCallback replace_illegal_characters_callback) { | |
| 222 // TODO: this function to be updated to match the httpbis recommendations. | |
| 223 // Talk to abarth for the latest news. | |
| 224 | |
| 225 // We don't translate this fallback string, "download". If localization is | |
| 226 // needed, the caller should provide localized fallback in |default_name|. | |
| 227 static const base::FilePath::CharType kFinalFallbackName[] = | |
| 228 FILE_PATH_LITERAL("download"); | |
| 229 std::string filename; // In UTF-8 | |
| 230 bool overwrite_extension = false; | |
| 231 bool is_name_from_content_disposition = false; | |
| 232 // Try to extract a filename from content-disposition first. | |
| 233 if (!content_disposition.empty()) { | |
| 234 HttpContentDisposition header(content_disposition, referrer_charset); | |
| 235 filename = header.filename(); | |
| 236 if (!filename.empty()) | |
| 237 is_name_from_content_disposition = true; | |
| 238 } | |
| 239 | |
| 240 // Then try to use the suggested name. | |
| 241 if (filename.empty() && !suggested_name.empty()) | |
| 242 filename = suggested_name; | |
| 243 | |
| 244 // Now try extracting the filename from the URL. GetFileNameFromURL() only | |
| 245 // looks at the last component of the URL and doesn't return the hostname as a | |
| 246 // failover. | |
| 247 if (filename.empty()) | |
| 248 filename = GetFileNameFromURL(url, referrer_charset, &overwrite_extension); | |
| 249 | |
| 250 // Finally try the URL hostname, but only if there's no default specified in | |
| 251 // |default_name|. Some schemes (e.g.: file:, about:, data:) do not have a | |
| 252 // host name. | |
| 253 if (filename.empty() && default_name.empty() && url.is_valid() && | |
| 254 !url.host().empty()) { | |
| 255 // TODO(jungshik) : Decode a 'punycoded' IDN hostname. (bug 1264451) | |
| 256 filename = url.host(); | |
| 257 } | |
| 258 | |
| 259 bool replace_trailing = false; | |
| 260 base::FilePath::StringType result_str, default_name_str; | |
| 261 #if defined(OS_WIN) | |
| 262 replace_trailing = true; | |
| 263 result_str = base::UTF8ToUTF16(filename); | |
| 264 default_name_str = base::UTF8ToUTF16(default_name); | |
| 265 #else | |
| 266 result_str = filename; | |
| 267 default_name_str = default_name; | |
| 268 #endif | |
| 269 SanitizeGeneratedFileName(&result_str, replace_trailing); | |
| 270 if (result_str.find_last_not_of(FILE_PATH_LITERAL("-_")) == | |
| 271 base::FilePath::StringType::npos) { | |
| 272 result_str = !default_name_str.empty() | |
| 273 ? default_name_str | |
| 274 : base::FilePath::StringType(kFinalFallbackName); | |
| 275 overwrite_extension = false; | |
| 276 } | |
| 277 replace_illegal_characters_callback.Run(&result_str, '-'); | |
| 278 base::FilePath result(result_str); | |
| 279 // extension should not appended to filename derived from | |
| 280 // content-disposition, if it does not have one. | |
| 281 // Hence mimetype and overwrite_extension values are not used. | |
| 282 if (is_name_from_content_disposition) | |
| 283 GenerateSafeFileName("", false, &result); | |
| 284 else | |
| 285 GenerateSafeFileName(mime_type, overwrite_extension, &result); | |
| 286 | |
| 287 base::string16 result16; | |
| 288 if (!FilePathToString16(result, &result16)) { | |
| 289 result = base::FilePath(default_name_str); | |
| 290 if (!FilePathToString16(result, &result16)) { | |
| 291 result = base::FilePath(kFinalFallbackName); | |
| 292 FilePathToString16(result, &result16); | |
| 293 } | |
| 294 } | |
| 295 return result16; | |
| 296 } | |
| 297 | |
| 298 base::FilePath GenerateFileNameImpl( | |
| 299 const GURL& url, | |
| 300 const std::string& content_disposition, | |
| 301 const std::string& referrer_charset, | |
| 302 const std::string& suggested_name, | |
| 303 const std::string& mime_type, | |
| 304 const std::string& default_file_name, | |
| 305 ReplaceIllegalCharactersCallback replace_illegal_characters_callback) { | |
| 306 base::string16 file_name = | |
| 307 GetSuggestedFilenameImpl(url, | |
| 308 content_disposition, | |
| 309 referrer_charset, | |
| 310 suggested_name, | |
| 311 mime_type, | |
| 312 default_file_name, | |
| 313 replace_illegal_characters_callback); | |
| 314 | |
| 315 #if defined(OS_WIN) | |
| 316 base::FilePath generated_name(file_name); | |
| 317 #else | |
| 318 base::FilePath generated_name( | |
| 319 base::SysWideToNativeMB(base::UTF16ToWide(file_name))); | |
| 320 #endif | |
| 321 | |
| 322 DCHECK(!generated_name.empty()); | |
| 323 | |
| 324 return generated_name; | |
| 325 } | |
| 326 | |
| 327 } // namespace net | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master