file_util.cc 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "extensions/common/file_util.h"
  5. #include <stddef.h>
  6. #include <stdint.h>
  7. #include <map>
  8. #include <memory>
  9. #include <set>
  10. #include <string>
  11. #include <utility>
  12. #include <vector>
  13. #include "base/files/file_enumerator.h"
  14. #include "base/files/file_path.h"
  15. #include "base/files/file_util.h"
  16. #include "base/files/scoped_temp_dir.h"
  17. #include "base/json/json_file_value_serializer.h"
  18. #include "base/logging.h"
  19. #include "base/metrics/field_trial.h"
  20. #include "base/metrics/histogram_macros.h"
  21. #include "base/strings/escape.h"
  22. #include "base/strings/string_number_conversions.h"
  23. #include "base/strings/string_piece.h"
  24. #include "base/strings/stringprintf.h"
  25. #include "base/strings/utf_string_conversions.h"
  26. #include "extensions/common/constants.h"
  27. #include "extensions/common/extension.h"
  28. #include "extensions/common/extension_icon_set.h"
  29. #include "extensions/common/extension_l10n_util.h"
  30. #include "extensions/common/extension_set.h"
  31. #include "extensions/common/image_util.h"
  32. #include "extensions/common/install_warning.h"
  33. #include "extensions/common/manifest.h"
  34. #include "extensions/common/manifest_constants.h"
  35. #include "extensions/common/manifest_handler.h"
  36. #include "extensions/common/manifest_handlers/default_locale_handler.h"
  37. #include "extensions/common/manifest_handlers/icons_handler.h"
  38. #include "extensions/strings/grit/extensions_strings.h"
  39. #include "net/base/filename_util.h"
  40. #include "ui/base/l10n/l10n_util.h"
  41. #include "url/gurl.h"
  42. using extensions::mojom::ManifestLocation;
  43. namespace extensions {
  44. namespace file_util {
  45. namespace {
  46. enum SafeInstallationFlag {
  47. DEFAULT, // Default case, controlled by a field trial.
  48. DISABLED, // Safe installation is disabled.
  49. ENABLED, // Safe installation is enabled.
  50. };
  51. SafeInstallationFlag g_use_safe_installation = DEFAULT;
  52. bool g_report_error_for_invisible_icon = false;
  53. // Returns true if the given file path exists and is not zero-length.
  54. bool ValidateFilePath(const base::FilePath& path) {
  55. int64_t size = 0;
  56. return base::PathExists(path) && base::GetFileSize(path, &size) && size != 0;
  57. }
  58. // Returns true if the extension installation should flush all files and the
  59. // directory.
  60. bool UseSafeInstallation() {
  61. if (g_use_safe_installation == DEFAULT) {
  62. const char kFieldTrialName[] = "ExtensionUseSafeInstallation";
  63. const char kEnable[] = "Enable";
  64. return base::FieldTrialList::FindFullName(kFieldTrialName) == kEnable;
  65. }
  66. return g_use_safe_installation == ENABLED;
  67. }
  68. enum FlushOneOrAllFiles {
  69. ONE_FILE_ONLY,
  70. ALL_FILES
  71. };
  72. // Flush all files in a directory or just one. When flushing all files, it
  73. // makes sure every file is on disk. When flushing one file only, it ensures
  74. // all parent directories are on disk.
  75. void FlushFilesInDir(const base::FilePath& path,
  76. FlushOneOrAllFiles one_or_all_files) {
  77. if (!UseSafeInstallation()) {
  78. return;
  79. }
  80. base::FileEnumerator temp_traversal(path,
  81. true, // recursive
  82. base::FileEnumerator::FILES);
  83. for (base::FilePath current = temp_traversal.Next(); !current.empty();
  84. current = temp_traversal.Next()) {
  85. base::File currentFile(current,
  86. base::File::FLAG_OPEN | base::File::FLAG_WRITE);
  87. currentFile.Flush();
  88. currentFile.Close();
  89. if (one_or_all_files == ONE_FILE_ONLY) {
  90. break;
  91. }
  92. }
  93. }
  94. } // namespace
  95. const base::FilePath::CharType kTempDirectoryName[] = FILE_PATH_LITERAL("Temp");
  96. void SetUseSafeInstallation(bool use_safe_installation) {
  97. g_use_safe_installation = use_safe_installation ? ENABLED : DISABLED;
  98. }
  99. base::FilePath InstallExtension(const base::FilePath& unpacked_source_dir,
  100. const std::string& id,
  101. const std::string& version,
  102. const base::FilePath& extensions_dir) {
  103. base::FilePath extension_dir = extensions_dir.AppendASCII(id);
  104. base::FilePath version_dir;
  105. // Create the extension directory if it doesn't exist already.
  106. if (!base::PathExists(extension_dir)) {
  107. if (!base::CreateDirectory(extension_dir))
  108. return base::FilePath();
  109. }
  110. // Get a temp directory on the same file system as the profile.
  111. base::FilePath install_temp_dir = GetInstallTempDir(extensions_dir);
  112. base::ScopedTempDir extension_temp_dir;
  113. if (install_temp_dir.empty() ||
  114. !extension_temp_dir.CreateUniqueTempDirUnderPath(install_temp_dir)) {
  115. LOG(ERROR) << "Creating of temp dir under in the profile failed.";
  116. return base::FilePath();
  117. }
  118. base::FilePath crx_temp_source =
  119. extension_temp_dir.GetPath().Append(unpacked_source_dir.BaseName());
  120. if (!base::Move(unpacked_source_dir, crx_temp_source)) {
  121. LOG(ERROR) << "Moving extension from : " << unpacked_source_dir.value()
  122. << " to : " << crx_temp_source.value() << " failed.";
  123. return base::FilePath();
  124. }
  125. // Try to find a free directory. There can be legitimate conflicts in the case
  126. // of overinstallation of the same version.
  127. const int kMaxAttempts = 100;
  128. for (int i = 0; i < kMaxAttempts; ++i) {
  129. base::FilePath candidate = extension_dir.AppendASCII(
  130. base::StringPrintf("%s_%u", version.c_str(), i));
  131. if (!base::PathExists(candidate)) {
  132. version_dir = candidate;
  133. break;
  134. }
  135. }
  136. if (version_dir.empty()) {
  137. LOG(ERROR) << "Could not find a home for extension " << id << " with "
  138. << "version " << version << ".";
  139. return base::FilePath();
  140. }
  141. // Flush the source dir completely before moving to make sure everything is
  142. // on disk. Otherwise a sudden power loss could cause the newly installed
  143. // extension to be in a corrupted state. Note that empty sub-directories
  144. // may still be lost.
  145. FlushFilesInDir(crx_temp_source, ALL_FILES);
  146. // The target version_dir does not exists yet, so base::Move() is using
  147. // rename() on POSIX systems. It is atomic in the sense that it will
  148. // either complete successfully or in the event of data loss be reverted.
  149. if (!base::Move(crx_temp_source, version_dir)) {
  150. LOG(ERROR) << "Installing extension from : " << crx_temp_source.value()
  151. << " into : " << version_dir.value() << " failed.";
  152. return base::FilePath();
  153. }
  154. // Flush one file in the new version_dir to make sure the dir move above is
  155. // persisted on disk. This is guaranteed on POSIX systems. ExtensionPrefs
  156. // is going to be updated with the new version_dir later. In the event of
  157. // data loss ExtensionPrefs should be pointing to the previous version which
  158. // is still fine.
  159. FlushFilesInDir(version_dir, ONE_FILE_ONLY);
  160. return version_dir;
  161. }
  162. void UninstallExtension(const base::FilePath& extensions_dir,
  163. const std::string& id) {
  164. // We don't care about the return value. If this fails (and it can, due to
  165. // plugins that aren't unloaded yet), it will get cleaned up by
  166. // ExtensionGarbageCollector::GarbageCollectExtensions.
  167. base::DeletePathRecursively(extensions_dir.AppendASCII(id));
  168. }
  169. scoped_refptr<Extension> LoadExtension(const base::FilePath& extension_path,
  170. ManifestLocation location,
  171. int flags,
  172. std::string* error) {
  173. return LoadExtension(extension_path, nullptr, std::string(), location, flags,
  174. error);
  175. }
  176. scoped_refptr<Extension> LoadExtension(const base::FilePath& extension_path,
  177. const std::string& extension_id,
  178. ManifestLocation location,
  179. int flags,
  180. std::string* error) {
  181. return LoadExtension(extension_path, nullptr, extension_id, location, flags,
  182. error);
  183. }
  184. scoped_refptr<Extension> LoadExtension(
  185. const base::FilePath& extension_path,
  186. const base::FilePath::CharType* manifest_file,
  187. const std::string& extension_id,
  188. ManifestLocation location,
  189. int flags,
  190. std::string* error) {
  191. std::unique_ptr<base::DictionaryValue> manifest;
  192. if (!manifest_file) {
  193. manifest = LoadManifest(extension_path, error);
  194. } else {
  195. manifest = LoadManifest(extension_path, manifest_file, error);
  196. }
  197. if (!manifest.get())
  198. return nullptr;
  199. if (!extension_l10n_util::LocalizeExtension(
  200. extension_path, manifest.get(),
  201. extension_l10n_util::GetGzippedMessagesPermissionForLocation(
  202. location),
  203. error)) {
  204. return nullptr;
  205. }
  206. scoped_refptr<Extension> extension(Extension::Create(
  207. extension_path, location, *manifest, flags, extension_id, error));
  208. if (!extension.get())
  209. return nullptr;
  210. std::vector<InstallWarning> warnings;
  211. if (!ValidateExtension(extension.get(), error, &warnings))
  212. return nullptr;
  213. extension->AddInstallWarnings(std::move(warnings));
  214. return extension;
  215. }
  216. std::unique_ptr<base::DictionaryValue> LoadManifest(
  217. const base::FilePath& extension_path,
  218. std::string* error) {
  219. return LoadManifest(extension_path, kManifestFilename, error);
  220. }
  221. std::unique_ptr<base::DictionaryValue> LoadManifest(
  222. const base::FilePath& extension_path,
  223. const base::FilePath::CharType* manifest_filename,
  224. std::string* error) {
  225. base::FilePath manifest_path = extension_path.Append(manifest_filename);
  226. if (!base::PathExists(manifest_path)) {
  227. *error = l10n_util::GetStringUTF8(IDS_EXTENSION_MANIFEST_UNREADABLE);
  228. return nullptr;
  229. }
  230. JSONFileValueDeserializer deserializer(manifest_path);
  231. std::unique_ptr<base::Value> root(deserializer.Deserialize(nullptr, error));
  232. if (!root.get()) {
  233. if (error->empty()) {
  234. // If |error| is empty, then the file could not be read.
  235. // It would be cleaner to have the JSON reader give a specific error
  236. // in this case, but other code tests for a file error with
  237. // error->empty(). For now, be consistent.
  238. *error = l10n_util::GetStringUTF8(IDS_EXTENSION_MANIFEST_UNREADABLE);
  239. } else {
  240. *error = base::StringPrintf(
  241. "%s %s", manifest_errors::kManifestParseError, error->c_str());
  242. }
  243. return nullptr;
  244. }
  245. if (!root->is_dict()) {
  246. *error = l10n_util::GetStringUTF8(IDS_EXTENSION_MANIFEST_INVALID);
  247. return nullptr;
  248. }
  249. return base::DictionaryValue::From(std::move(root));
  250. }
  251. bool ValidateExtension(const Extension* extension,
  252. std::string* error,
  253. std::vector<InstallWarning>* warnings) {
  254. // Ask registered manifest handlers to validate their paths.
  255. if (!ManifestHandler::ValidateExtension(extension, error, warnings))
  256. return false;
  257. // Check children of extension root to see if any of them start with _ and is
  258. // not on the reserved list. We only warn, and do not block the loading of the
  259. // extension.
  260. std::string warning;
  261. if (!CheckForIllegalFilenames(extension->path(), &warning))
  262. warnings->push_back(InstallWarning(warning));
  263. // Check that the extension does not include any Windows reserved filenames.
  264. std::string windows_reserved_warning;
  265. if (!CheckForWindowsReservedFilenames(extension->path(),
  266. &windows_reserved_warning)) {
  267. warnings->push_back(InstallWarning(windows_reserved_warning));
  268. }
  269. // Check that extensions don't include private key files.
  270. std::vector<base::FilePath> private_keys =
  271. FindPrivateKeyFiles(extension->path());
  272. if (extension->creation_flags() & Extension::ERROR_ON_PRIVATE_KEY) {
  273. if (!private_keys.empty()) {
  274. // Only print one of the private keys because l10n_util doesn't have a way
  275. // to translate a list of strings.
  276. *error =
  277. l10n_util::GetStringFUTF8(IDS_EXTENSION_CONTAINS_PRIVATE_KEY,
  278. private_keys.front().LossyDisplayName());
  279. return false;
  280. }
  281. } else {
  282. for (size_t i = 0; i < private_keys.size(); ++i) {
  283. warnings->push_back(InstallWarning(
  284. l10n_util::GetStringFUTF8(IDS_EXTENSION_CONTAINS_PRIVATE_KEY,
  285. private_keys[i].LossyDisplayName())));
  286. }
  287. // Only warn; don't block loading the extension.
  288. }
  289. return true;
  290. }
  291. std::vector<base::FilePath> FindPrivateKeyFiles(
  292. const base::FilePath& extension_dir) {
  293. std::vector<base::FilePath> result;
  294. // Pattern matching only works at the root level, so filter manually.
  295. base::FileEnumerator traversal(
  296. extension_dir, /*recursive=*/true, base::FileEnumerator::FILES);
  297. for (base::FilePath current = traversal.Next(); !current.empty();
  298. current = traversal.Next()) {
  299. if (!current.MatchesExtension(kExtensionKeyFileExtension))
  300. continue;
  301. std::string key_contents;
  302. if (!base::ReadFileToString(current, &key_contents)) {
  303. // If we can't read the file, assume it's not a private key.
  304. continue;
  305. }
  306. std::string key_bytes;
  307. if (!Extension::ParsePEMKeyBytes(key_contents, &key_bytes)) {
  308. // If we can't parse the key, assume it's ok too.
  309. continue;
  310. }
  311. result.push_back(current);
  312. }
  313. return result;
  314. }
  315. bool CheckForIllegalFilenames(const base::FilePath& extension_path,
  316. std::string* error) {
  317. // Enumerate all files and directories in the extension root.
  318. // There is a problem when using pattern "_*" with FileEnumerator, so we have
  319. // to cheat with find_first_of and match all.
  320. const int kFilesAndDirectories =
  321. base::FileEnumerator::DIRECTORIES | base::FileEnumerator::FILES;
  322. base::FileEnumerator all_files(extension_path, false, kFilesAndDirectories);
  323. base::FilePath file;
  324. while (!(file = all_files.Next()).empty()) {
  325. base::FilePath::StringType filename = file.BaseName().value();
  326. // Skip all filenames that don't start with "_".
  327. if (filename.find_first_of(FILE_PATH_LITERAL("_")) != 0)
  328. continue;
  329. // Some filenames are special and allowed to start with "_".
  330. if (filename == kLocaleFolder || filename == kPlatformSpecificFolder ||
  331. filename == FILE_PATH_LITERAL("__MACOSX")) {
  332. continue;
  333. }
  334. *error = base::StringPrintf(
  335. "Cannot load extension with file or directory name %s. "
  336. "Filenames starting with \"_\" are reserved for use by the system.",
  337. file.BaseName().AsUTF8Unsafe().c_str());
  338. return false;
  339. }
  340. return true;
  341. }
  342. bool CheckForWindowsReservedFilenames(const base::FilePath& extension_dir,
  343. std::string* error) {
  344. const int kFilesAndDirectories =
  345. base::FileEnumerator::DIRECTORIES | base::FileEnumerator::FILES;
  346. base::FileEnumerator traversal(extension_dir, true, kFilesAndDirectories);
  347. for (base::FilePath current = traversal.Next(); !current.empty();
  348. current = traversal.Next()) {
  349. base::FilePath::StringType filename = current.BaseName().value();
  350. bool is_reserved_filename = net::IsReservedNameOnWindows(filename);
  351. if (is_reserved_filename) {
  352. *error = base::StringPrintf(
  353. "Cannot load extension with file or directory name %s. "
  354. "The filename is illegal.",
  355. current.BaseName().AsUTF8Unsafe().c_str());
  356. return false;
  357. }
  358. }
  359. return true;
  360. }
  361. base::FilePath GetInstallTempDir(const base::FilePath& extensions_dir) {
  362. // We do file IO in this function, but only when the current profile's
  363. // Temp directory has never been used before, or in a rare error case.
  364. // Developers are not likely to see these situations often.
  365. // Create the temp directory as a sub-directory of the Extensions directory.
  366. // This guarantees it is on the same file system as the extension's eventual
  367. // install target.
  368. base::FilePath temp_path = extensions_dir.Append(kTempDirectoryName);
  369. if (base::PathExists(temp_path)) {
  370. if (!base::DirectoryExists(temp_path)) {
  371. DLOG(WARNING) << "Not a directory: " << temp_path.value();
  372. return base::FilePath();
  373. }
  374. if (!base::PathIsWritable(temp_path)) {
  375. DLOG(WARNING) << "Can't write to path: " << temp_path.value();
  376. return base::FilePath();
  377. }
  378. // This is a directory we can write to.
  379. return temp_path;
  380. }
  381. // Directory doesn't exist, so create it.
  382. if (!base::CreateDirectory(temp_path)) {
  383. DLOG(WARNING) << "Couldn't create directory: " << temp_path.value();
  384. return base::FilePath();
  385. }
  386. return temp_path;
  387. }
  388. base::FilePath ExtensionURLToRelativeFilePath(const GURL& url) {
  389. base::StringPiece url_path = url.path_piece();
  390. if (url_path.empty() || url_path[0] != '/')
  391. return base::FilePath();
  392. // Convert %-encoded UTF8 to regular UTF8.
  393. std::string file_path;
  394. if (!base::UnescapeBinaryURLComponentSafe(
  395. url_path, true /* fail_on_path_separators */, &file_path)) {
  396. // There shouldn't be any escaped path separators or control characters in
  397. // the path. However, if there are, it's best to just fail.
  398. return base::FilePath();
  399. }
  400. // Drop the leading slashes.
  401. size_t skip = file_path.find_first_not_of("/\\");
  402. if (skip != file_path.npos)
  403. file_path = file_path.substr(skip);
  404. base::FilePath path = base::FilePath::FromUTF8Unsafe(file_path);
  405. // It's still possible for someone to construct an annoying URL whose path
  406. // would still wind up not being considered relative at this point.
  407. // For example: chrome-extension://id/c:////foo.html
  408. if (path.IsAbsolute())
  409. return base::FilePath();
  410. return path;
  411. }
  412. void SetReportErrorForInvisibleIconForTesting(bool value) {
  413. g_report_error_for_invisible_icon = value;
  414. }
  415. bool ValidateExtensionIconSet(const ExtensionIconSet& icon_set,
  416. const Extension* extension,
  417. const char* manifest_key,
  418. SkColor background_color,
  419. std::string* error) {
  420. for (const auto& entry : icon_set.map()) {
  421. const base::FilePath path =
  422. extension->GetResource(entry.second).GetFilePath();
  423. if (!ValidateFilePath(path)) {
  424. constexpr char kIconMissingError[] =
  425. "Could not load icon '%s' specified in '%s'.";
  426. *error = base::StringPrintf(kIconMissingError, entry.second.c_str(),
  427. manifest_key);
  428. return false;
  429. }
  430. if (extension->location() == ManifestLocation::kUnpacked) {
  431. const bool is_sufficiently_visible =
  432. image_util::IsIconAtPathSufficientlyVisible(path);
  433. const bool is_sufficiently_visible_rendered =
  434. image_util::IsRenderedIconAtPathSufficientlyVisible(path,
  435. background_color);
  436. UMA_HISTOGRAM_BOOLEAN(
  437. "Extensions.ManifestIconSetIconWasVisibleForUnpacked",
  438. is_sufficiently_visible);
  439. UMA_HISTOGRAM_BOOLEAN(
  440. "Extensions.ManifestIconSetIconWasVisibleForUnpackedRendered",
  441. is_sufficiently_visible_rendered);
  442. if (!is_sufficiently_visible && g_report_error_for_invisible_icon) {
  443. constexpr char kIconNotSufficientlyVisibleError[] =
  444. "Icon '%s' specified in '%s' is not sufficiently visible.";
  445. *error = base::StringPrintf(kIconNotSufficientlyVisibleError,
  446. entry.second.c_str(), manifest_key);
  447. return false;
  448. }
  449. }
  450. }
  451. return true;
  452. }
  453. MessageBundle* LoadMessageBundle(
  454. const base::FilePath& extension_path,
  455. const std::string& default_locale,
  456. extension_l10n_util::GzippedMessagesPermission gzip_permission,
  457. std::string* error) {
  458. error->clear();
  459. // Load locale information if available.
  460. base::FilePath locale_path = extension_path.Append(kLocaleFolder);
  461. if (!base::PathExists(locale_path))
  462. return nullptr;
  463. std::set<std::string> chrome_locales;
  464. extension_l10n_util::GetAllLocales(&chrome_locales);
  465. base::FilePath default_locale_path = locale_path.AppendASCII(default_locale);
  466. if (default_locale.empty() ||
  467. chrome_locales.find(default_locale) == chrome_locales.end() ||
  468. !base::PathExists(default_locale_path)) {
  469. *error = l10n_util::GetStringUTF8(
  470. IDS_EXTENSION_LOCALES_NO_DEFAULT_LOCALE_SPECIFIED);
  471. return nullptr;
  472. }
  473. MessageBundle* message_bundle = extension_l10n_util::LoadMessageCatalogs(
  474. locale_path, default_locale, gzip_permission, error);
  475. return message_bundle;
  476. }
  477. base::FilePath GetVerifiedContentsPath(const base::FilePath& extension_path) {
  478. return extension_path.Append(kMetadataFolder)
  479. .Append(kVerifiedContentsFilename);
  480. }
  481. base::FilePath GetComputedHashesPath(const base::FilePath& extension_path) {
  482. return extension_path.Append(kMetadataFolder).Append(kComputedHashesFilename);
  483. }
  484. base::FilePath GetIndexedRulesetDirectoryRelativePath() {
  485. return base::FilePath(kMetadataFolder).Append(kIndexedRulesetDirectory);
  486. }
  487. base::FilePath GetIndexedRulesetRelativePath(int static_ruleset_id) {
  488. const char* kRulesetPrefix = "_ruleset";
  489. std::string filename =
  490. kRulesetPrefix + base::NumberToString(static_ruleset_id);
  491. return GetIndexedRulesetDirectoryRelativePath().AppendASCII(filename);
  492. }
  493. std::vector<base::FilePath> GetReservedMetadataFilePaths(
  494. const base::FilePath& extension_path) {
  495. return {GetVerifiedContentsPath(extension_path),
  496. GetComputedHashesPath(extension_path),
  497. extension_path.Append(GetIndexedRulesetDirectoryRelativePath())};
  498. }
  499. } // namespace file_util
  500. } // namespace extensions