1 // Copyright 2014 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "net/base/filename_util.h" 6 7 #include "base/files/file_path.h" 8 #include "base/files/file_util.h" 9 #include "base/path_service.h" 10 #include "base/strings/string_util.h" 11 #include "base/strings/sys_string_conversions.h" 12 #include "base/strings/utf_string_conversions.h" 13 #include "base/threading/thread_restrictions.h" 14 #include "net/base/escape.h" 15 #include "net/base/filename_util_internal.h" 16 #include "net/base/mime_util.h" 17 #include "net/base/net_string_util.h" 18 #include "net/http/http_content_disposition.h" 19 #include "url/gurl.h" 20 21 namespace net { 22 23 void SanitizeGeneratedFileName(base::FilePath::StringType* filename, 24 bool replace_trailing) { 25 const base::FilePath::CharType kReplace[] = FILE_PATH_LITERAL("-"); 26 if (filename->empty()) 27 return; 28 if (replace_trailing) { 29 // Handle CreateFile() stripping trailing dots and spaces on filenames 30 // http://support.microsoft.com/kb/115827 31 size_t length = filename->size(); 32 size_t pos = filename->find_last_not_of(FILE_PATH_LITERAL(" .")); 33 filename->resize((pos == std::string::npos) ? 0 : (pos + 1)); 34 base::TrimWhitespace(*filename, base::TRIM_TRAILING, filename); 35 if (filename->empty()) 36 return; 37 size_t trimmed = length - filename->size(); 38 if (trimmed) 39 filename->insert(filename->end(), trimmed, kReplace[0]); 40 } 41 base::TrimString(*filename, FILE_PATH_LITERAL("."), filename); 42 if (filename->empty()) 43 return; 44 // Replace any path information by changing path separators. 45 ReplaceSubstringsAfterOffset(filename, 0, FILE_PATH_LITERAL("/"), kReplace); 46 ReplaceSubstringsAfterOffset(filename, 0, FILE_PATH_LITERAL("\\"), kReplace); 47 } 48 49 // Returns the filename determined from the last component of the path portion 50 // of the URL. Returns an empty string if the URL doesn't have a path or is 51 // invalid. If the generated filename is not reliable, 52 // |should_overwrite_extension| will be set to true, in which case a better 53 // extension should be determined based on the content type. 54 std::string GetFileNameFromURL(const GURL& url, 55 const std::string& referrer_charset, 56 bool* should_overwrite_extension) { 57 // about: and data: URLs don't have file names, but esp. data: URLs may 58 // contain parts that look like ones (i.e., contain a slash). Therefore we 59 // don't attempt to divine a file name out of them. 60 if (!url.is_valid() || url.SchemeIs("about") || url.SchemeIs("data")) 61 return std::string(); 62 63 const std::string unescaped_url_filename = UnescapeURLComponent( 64 url.ExtractFileName(), 65 UnescapeRule::SPACES | UnescapeRule::URL_SPECIAL_CHARS); 66 67 // The URL's path should be escaped UTF-8, but may not be. 68 std::string decoded_filename = unescaped_url_filename; 69 if (!base::IsStringUTF8(decoded_filename)) { 70 // TODO(jshin): this is probably not robust enough. To be sure, we need 71 // encoding detection. 72 base::string16 utf16_output; 73 if (!referrer_charset.empty() && 74 net::ConvertToUTF16( 75 unescaped_url_filename, referrer_charset.c_str(), &utf16_output)) { 76 decoded_filename = base::UTF16ToUTF8(utf16_output); 77 } else { 78 decoded_filename = 79 base::WideToUTF8(base::SysNativeMBToWide(unescaped_url_filename)); 80 } 81 } 82 // If the URL contains a (possibly empty) query, assume it is a generator, and 83 // allow the determined extension to be overwritten. 84 *should_overwrite_extension = !decoded_filename.empty() && url.has_query(); 85 86 return decoded_filename; 87 } 88 89 // Returns whether the specified extension is automatically integrated into the 90 // windows shell. 91 bool IsShellIntegratedExtension(const base::FilePath::StringType& extension) { 92 base::FilePath::StringType extension_lower = 93 base::StringToLowerASCII(extension); 94 95 // http://msdn.microsoft.com/en-us/library/ms811694.aspx 96 // Right-clicking on shortcuts can be magical. 97 if ((extension_lower == FILE_PATH_LITERAL("local")) || 98 (extension_lower == FILE_PATH_LITERAL("lnk"))) 99 return true; 100 101 // http://www.juniper.net/security/auto/vulnerabilities/vuln2612.html 102 // Files become magical if they end in a CLSID, so block such extensions. 103 if (!extension_lower.empty() && 104 (extension_lower[0] == FILE_PATH_LITERAL('{')) && 105 (extension_lower[extension_lower.length() - 1] == FILE_PATH_LITERAL('}'))) 106 return true; 107 return false; 108 } 109 110 // Returns whether the specified file name is a reserved name on windows. 111 // This includes names like "com2.zip" (which correspond to devices) and 112 // desktop.ini and thumbs.db which have special meaning to the windows shell. 113 bool IsReservedName(const base::FilePath::StringType& filename) { 114 // This list is taken from the MSDN article "Naming a file" 115 // http://msdn2.microsoft.com/en-us/library/aa365247(VS.85).aspx 116 // I also added clock$ because GetSaveFileName seems to consider it as a 117 // reserved name too. 118 static const char* const known_devices[] = { 119 "con", "prn", "aux", "nul", "com1", "com2", "com3", "com4", 120 "com5", "com6", "com7", "com8", "com9", "lpt1", "lpt2", "lpt3", 121 "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9", "clock$"}; 122 #if defined(OS_WIN) 123 std::string filename_lower = 124 base::StringToLowerASCII(base::WideToUTF8(filename)); 125 #elif defined(OS_POSIX) 126 std::string filename_lower = base::StringToLowerASCII(filename); 127 #endif 128 129 for (size_t i = 0; i < arraysize(known_devices); ++i) { 130 // Exact match. 131 if (filename_lower == known_devices[i]) 132 return true; 133 // Starts with "DEVICE.". 134 if (filename_lower.find(std::string(known_devices[i]) + ".") == 0) 135 return true; 136 } 137 138 static const char* const magic_names[] = { 139 // These file names are used by the "Customize folder" feature of the shell. 140 "desktop.ini", 141 "thumbs.db", 142 }; 143 144 for (size_t i = 0; i < arraysize(magic_names); ++i) { 145 if (filename_lower == magic_names[i]) 146 return true; 147 } 148 149 return false; 150 } 151 152 // Examines the current extension in |file_name| and modifies it if necessary in 153 // order to ensure the filename is safe. If |file_name| doesn't contain an 154 // extension or if |ignore_extension| is true, then a new extension will be 155 // constructed based on the |mime_type|. 156 // 157 // We're addressing two things here: 158 // 159 // 1) Usability. If there is no reliable file extension, we want to guess a 160 // reasonable file extension based on the content type. 161 // 162 // 2) Shell integration. Some file extensions automatically integrate with the 163 // shell. We block these extensions to prevent a malicious web site from 164 // integrating with the user's shell. 165 void EnsureSafeExtension(const std::string& mime_type, 166 bool ignore_extension, 167 base::FilePath* file_name) { 168 // See if our file name already contains an extension. 169 base::FilePath::StringType extension = file_name->Extension(); 170 if (!extension.empty()) 171 extension.erase(extension.begin()); // Erase preceding '.'. 172 173 if ((ignore_extension || extension.empty()) && !mime_type.empty()) { 174 base::FilePath::StringType preferred_mime_extension; 175 std::vector<base::FilePath::StringType> all_mime_extensions; 176 net::GetPreferredExtensionForMimeType(mime_type, &preferred_mime_extension); 177 net::GetExtensionsForMimeType(mime_type, &all_mime_extensions); 178 // If the existing extension is in the list of valid extensions for the 179 // given type, use it. This avoids doing things like pointlessly renaming 180 // "foo.jpg" to "foo.jpeg". 181 if (std::find(all_mime_extensions.begin(), 182 all_mime_extensions.end(), 183 extension) != all_mime_extensions.end()) { 184 // leave |extension| alone 185 } else if (!preferred_mime_extension.empty()) { 186 extension = preferred_mime_extension; 187 } 188 } 189 190 #if defined(OS_WIN) 191 static const base::FilePath::CharType default_extension[] = 192 FILE_PATH_LITERAL("download"); 193 194 // Rename shell-integrated extensions. 195 // TODO(asanka): Consider stripping out the bad extension and replacing it 196 // with the preferred extension for the MIME type if one is available. 197 if (IsShellIntegratedExtension(extension)) 198 extension.assign(default_extension); 199 #endif 200 201 *file_name = file_name->ReplaceExtension(extension); 202 } 203 204 bool FilePathToString16(const base::FilePath& path, base::string16* converted) { 205 #if defined(OS_WIN) 206 return base::WideToUTF16( 207 path.value().c_str(), path.value().size(), converted); 208 #elif defined(OS_POSIX) 209 std::string component8 = path.AsUTF8Unsafe(); 210 return !component8.empty() && 211 base::UTF8ToUTF16(component8.c_str(), component8.size(), converted); 212 #endif 213 } 214 215 base::string16 GetSuggestedFilenameImpl( 216 const GURL& url, 217 const std::string& content_disposition, 218 const std::string& referrer_charset, 219 const std::string& suggested_name, 220 const std::string& mime_type, 221 const std::string& default_name, 222 ReplaceIllegalCharactersCallback replace_illegal_characters_callback) { 223 // TODO: this function to be updated to match the httpbis recommendations. 224 // Talk to abarth for the latest news. 225 226 // We don't translate this fallback string, "download". If localization is 227 // needed, the caller should provide localized fallback in |default_name|. 228 static const base::FilePath::CharType kFinalFallbackName[] = 229 FILE_PATH_LITERAL("download"); 230 std::string filename; // In UTF-8 231 bool overwrite_extension = false; 232 233 // Try to extract a filename from content-disposition first. 234 if (!content_disposition.empty()) { 235 HttpContentDisposition header(content_disposition, referrer_charset); 236 filename = header.filename(); 237 } 238 239 // Then try to use the suggested name. 240 if (filename.empty() && !suggested_name.empty()) 241 filename = suggested_name; 242 243 // Now try extracting the filename from the URL. GetFileNameFromURL() only 244 // looks at the last component of the URL and doesn't return the hostname as a 245 // failover. 246 if (filename.empty()) 247 filename = GetFileNameFromURL(url, referrer_charset, &overwrite_extension); 248 249 // Finally try the URL hostname, but only if there's no default specified in 250 // |default_name|. Some schemes (e.g.: file:, about:, data:) do not have a 251 // host name. 252 if (filename.empty() && default_name.empty() && url.is_valid() && 253 !url.host().empty()) { 254 // TODO(jungshik) : Decode a 'punycoded' IDN hostname. (bug 1264451) 255 filename = url.host(); 256 } 257 258 bool replace_trailing = false; 259 base::FilePath::StringType result_str, default_name_str; 260 #if defined(OS_WIN) 261 replace_trailing = true; 262 result_str = base::UTF8ToUTF16(filename); 263 default_name_str = base::UTF8ToUTF16(default_name); 264 #else 265 result_str = filename; 266 default_name_str = default_name; 267 #endif 268 SanitizeGeneratedFileName(&result_str, replace_trailing); 269 if (result_str.find_last_not_of(FILE_PATH_LITERAL("-_")) == 270 base::FilePath::StringType::npos) { 271 result_str = !default_name_str.empty() 272 ? default_name_str 273 : base::FilePath::StringType(kFinalFallbackName); 274 overwrite_extension = false; 275 } 276 replace_illegal_characters_callback.Run(&result_str, '-'); 277 base::FilePath result(result_str); 278 GenerateSafeFileName(mime_type, overwrite_extension, &result); 279 280 base::string16 result16; 281 if (!FilePathToString16(result, &result16)) { 282 result = base::FilePath(default_name_str); 283 if (!FilePathToString16(result, &result16)) { 284 result = base::FilePath(kFinalFallbackName); 285 FilePathToString16(result, &result16); 286 } 287 } 288 return result16; 289 } 290 291 base::FilePath GenerateFileNameImpl( 292 const GURL& url, 293 const std::string& content_disposition, 294 const std::string& referrer_charset, 295 const std::string& suggested_name, 296 const std::string& mime_type, 297 const std::string& default_file_name, 298 ReplaceIllegalCharactersCallback replace_illegal_characters_callback) { 299 base::string16 file_name = 300 GetSuggestedFilenameImpl(url, 301 content_disposition, 302 referrer_charset, 303 suggested_name, 304 mime_type, 305 default_file_name, 306 replace_illegal_characters_callback); 307 308 #if defined(OS_WIN) 309 base::FilePath generated_name(file_name); 310 #else 311 base::FilePath generated_name( 312 base::SysWideToNativeMB(base::UTF16ToWide(file_name))); 313 #endif 314 315 DCHECK(!generated_name.empty()); 316 317 return generated_name; 318 } 319 320 } // namespace net 321
