Home | History | Annotate | Download | only in extensions 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #ifndef CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
      6 #define CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
      7 
      8 #include <string>
      9 
     10 #include "base/files/file_path.h"
     11 #include "base/files/scoped_temp_dir.h"
     12 #include "base/memory/ref_counted.h"
     13 #include "base/time/time.h"
     14 #include "content/public/browser/utility_process_host_client.h"
     15 #include "extensions/common/manifest.h"
     16 
     17 class SkBitmap;
     18 
     19 namespace base {
     20 class DictionaryValue;
     21 class SequencedTaskRunner;
     22 }
     23 
     24 namespace extensions {
     25 class Extension;
     26 
     27 class SandboxedUnpackerClient
     28     : public base::RefCountedThreadSafe<SandboxedUnpackerClient> {
     29  public:
     30   // temp_dir - A temporary directory containing the results of the extension
     31   // unpacking. The client is responsible for deleting this directory.
     32   //
     33   // extension_root - The path to the extension root inside of temp_dir.
     34   //
     35   // original_manifest - The parsed but unmodified version of the manifest,
     36   // with no modifications such as localization, etc.
     37   //
     38   // extension - The extension that was unpacked. The client is responsible
     39   // for deleting this memory.
     40   //
     41   // install_icon - The icon we will display in the installation UI, if any.
     42   virtual void OnUnpackSuccess(const base::FilePath& temp_dir,
     43                                const base::FilePath& extension_root,
     44                                const base::DictionaryValue* original_manifest,
     45                                const Extension* extension,
     46                                const SkBitmap& install_icon) = 0;
     47   virtual void OnUnpackFailure(const base::string16& error) = 0;
     48 
     49  protected:
     50   friend class base::RefCountedThreadSafe<SandboxedUnpackerClient>;
     51 
     52   virtual ~SandboxedUnpackerClient() {}
     53 };
     54 
     55 // SandboxedUnpacker unpacks extensions from the CRX format into a
     56 // directory. This is done in a sandboxed subprocess to protect the browser
     57 // process from parsing complex formats like JPEG or JSON from untrusted
     58 // sources.
     59 //
     60 // Unpacking an extension using this class makes minor changes to its source,
     61 // such as transcoding all images to PNG, parsing all message catalogs
     62 // and rewriting the manifest JSON. As such, it should not be used when the
     63 // output is not intended to be given back to the author.
     64 //
     65 //
     66 // Lifetime management:
     67 //
     68 // This class is ref-counted by each call it makes to itself on another thread,
     69 // and by UtilityProcessHost.
     70 //
     71 // Additionally, we hold a reference to our own client so that it lives at least
     72 // long enough to receive the result of unpacking.
     73 //
     74 //
     75 // NOTE: This class should only be used on the file thread.
     76 class SandboxedUnpacker : public content::UtilityProcessHostClient {
     77  public:
     78   // Unpacks the extension in |crx_path| into a temporary directory and calls
     79   // |client| with the result. If |run_out_of_process| is provided, unpacking
     80   // is done in a sandboxed subprocess. Otherwise, it is done in-process.
     81   SandboxedUnpacker(
     82       const base::FilePath& crx_path,
     83       Manifest::Location location,
     84       int creation_flags,
     85       const base::FilePath& extensions_dir,
     86       const scoped_refptr<base::SequencedTaskRunner>& unpacker_io_task_runner,
     87       SandboxedUnpackerClient* client);
     88 
     89   // Start unpacking the extension. The client is called with the results.
     90   void Start();
     91 
     92  private:
     93   class ProcessHostClient;
     94 
     95   // Enumerate all the ways unpacking can fail.  Calls to ReportFailure()
     96   // take a failure reason as an argument, and put it in histogram
     97   // Extensions.SandboxUnpackFailureReason.
     98   enum FailureReason {
     99     // SandboxedUnpacker::CreateTempDirectory()
    100     COULD_NOT_GET_TEMP_DIRECTORY,
    101     COULD_NOT_CREATE_TEMP_DIRECTORY,
    102 
    103     // SandboxedUnpacker::Start()
    104     FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY,
    105     COULD_NOT_GET_SANDBOX_FRIENDLY_PATH,
    106 
    107     // SandboxedUnpacker::OnUnpackExtensionSucceeded()
    108     COULD_NOT_LOCALIZE_EXTENSION,
    109     INVALID_MANIFEST,
    110 
    111     // SandboxedUnpacker::OnUnpackExtensionFailed()
    112     UNPACKER_CLIENT_FAILED,
    113 
    114     // SandboxedUnpacker::OnProcessCrashed()
    115     UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL,
    116 
    117     // SandboxedUnpacker::ValidateSignature()
    118     CRX_FILE_NOT_READABLE,
    119     CRX_HEADER_INVALID,
    120     CRX_MAGIC_NUMBER_INVALID,
    121     CRX_VERSION_NUMBER_INVALID,
    122     CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE,
    123     CRX_ZERO_KEY_LENGTH,
    124     CRX_ZERO_SIGNATURE_LENGTH,
    125     CRX_PUBLIC_KEY_INVALID,
    126     CRX_SIGNATURE_INVALID,
    127     CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED,
    128     CRX_SIGNATURE_VERIFICATION_FAILED,
    129 
    130     // SandboxedUnpacker::RewriteManifestFile()
    131     ERROR_SERIALIZING_MANIFEST_JSON,
    132     ERROR_SAVING_MANIFEST_JSON,
    133 
    134     // SandboxedUnpacker::RewriteImageFiles()
    135     COULD_NOT_READ_IMAGE_DATA_FROM_DISK,
    136     DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST,
    137     INVALID_PATH_FOR_BROWSER_IMAGE,
    138     ERROR_REMOVING_OLD_IMAGE_FILE,
    139     INVALID_PATH_FOR_BITMAP_IMAGE,
    140     ERROR_RE_ENCODING_THEME_IMAGE,
    141     ERROR_SAVING_THEME_IMAGE,
    142     ABORTED_DUE_TO_SHUTDOWN,
    143 
    144     // SandboxedUnpacker::RewriteCatalogFiles()
    145     COULD_NOT_READ_CATALOG_DATA_FROM_DISK,
    146     INVALID_CATALOG_DATA,
    147     INVALID_PATH_FOR_CATALOG,
    148     ERROR_SERIALIZING_CATALOG,
    149     ERROR_SAVING_CATALOG,
    150 
    151     NUM_FAILURE_REASONS
    152   };
    153 
    154   friend class ProcessHostClient;
    155   friend class SandboxedUnpackerTest;
    156 
    157   virtual ~SandboxedUnpacker();
    158 
    159   // Set |temp_dir_| as a temporary directory to unpack the extension in.
    160   // Return true on success.
    161   virtual bool CreateTempDirectory();
    162 
    163   // Validates the signature of the extension and extract the key to
    164   // |public_key_|. Returns true if the signature validates, false otherwise.
    165   //
    166   // NOTE: Having this method here is a bit ugly. This code should really live
    167   // in extensions::Unpacker as it is not specific to sandboxed unpacking. It
    168   // was put here because we cannot run windows crypto code in the sandbox. But
    169   // we could still have this method statically on extensions::Unpacker so that
    170   // code just for unpacking is there and code just for sandboxing of unpacking
    171   // is here.
    172   bool ValidateSignature();
    173 
    174   // Starts the utility process that unpacks our extension.
    175   void StartProcessOnIOThread(const base::FilePath& temp_crx_path);
    176 
    177   // UtilityProcessHostClient
    178   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
    179   virtual void OnProcessCrashed(int exit_code) OVERRIDE;
    180 
    181   // IPC message handlers.
    182   void OnUnpackExtensionSucceeded(const base::DictionaryValue& manifest);
    183   void OnUnpackExtensionFailed(const base::string16& error_message);
    184 
    185   void ReportFailure(FailureReason reason, const base::string16& message);
    186   void ReportSuccess(const base::DictionaryValue& original_manifest,
    187                      const SkBitmap& install_icon);
    188 
    189   // Overwrites original manifest with safe result from utility process.
    190   // Returns NULL on error. Caller owns the returned object.
    191   base::DictionaryValue* RewriteManifestFile(
    192       const base::DictionaryValue& manifest);
    193 
    194   // Overwrites original files with safe results from utility process.
    195   // Reports error and returns false if it fails.
    196   bool RewriteImageFiles(SkBitmap* install_icon);
    197   bool RewriteCatalogFiles();
    198 
    199   // Cleans up temp directory artifacts.
    200   void Cleanup();
    201 
    202   // The path to the CRX to unpack.
    203   base::FilePath crx_path_;
    204 
    205   // Our client.
    206   scoped_refptr<SandboxedUnpackerClient> client_;
    207 
    208   // The Extensions directory inside the profile.
    209   base::FilePath extensions_dir_;
    210 
    211   // A temporary directory to use for unpacking.
    212   base::ScopedTempDir temp_dir_;
    213 
    214   // The root directory of the unpacked extension. This is a child of temp_dir_.
    215   base::FilePath extension_root_;
    216 
    217   // Represents the extension we're unpacking.
    218   scoped_refptr<Extension> extension_;
    219 
    220   // Whether we've received a response from the utility process yet.
    221   bool got_response_;
    222 
    223   // The public key that was extracted from the CRX header.
    224   std::string public_key_;
    225 
    226   // The extension's ID. This will be calculated from the public key in the crx
    227   // header.
    228   std::string extension_id_;
    229 
    230   // Time at which unpacking started. Used to compute the time unpacking takes.
    231   base::TimeTicks unpack_start_time_;
    232 
    233   // Location to use for the unpacked extension.
    234   Manifest::Location location_;
    235 
    236   // Creation flags to use for the extension.  These flags will be used
    237   // when calling Extenion::Create() by the crx installer.
    238   int creation_flags_;
    239 
    240   // Sequenced task runner where file I/O operations will be performed at.
    241   scoped_refptr<base::SequencedTaskRunner> unpacker_io_task_runner_;
    242 };
    243 
    244 }  // namespace extensions
    245 
    246 #endif  // CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
    247