Prevent developers from accidentally including their private keys in extensions.

This puts a warning on chrome://extensions in developer mode when an
unpacked extension includes a parsable .pem file, and fails an attempt
to pack such an extension.

This doesn't yet identify when an extension includes its own private
key because RSAPrivateKey currently requires loading from the
filesystem on Mac, and the utility process that first loads an
extension is prohibited from doing that.

BUG=130140

TEST=unit_tests --gtest_filter=Extension*;
Manually ran chrome and tried to load and pack an extension containing
a private key.


Review URL: https://chromiumcodereview.appspot.com/10451086

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@140128 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 44 insertions, 1 deletions

diff --git a/chrome/browser/extensions/extension_creator.cc b/chrome/browser/extensions/extension_creator.cc
index ea03d3a..61e0134 100644
--- a/chrome/browser/extensions/extension_creator.cc
+++ b/chrome/browser/extensions/extension_creator.cc
@@ -107,7 +107,7 @@ bool ExtensionCreator::ValidateManifest(const FilePath& extension_dir,
           extension_dir,
           extension_id,
           Extension::INTERNAL,
-          Extension::FOLLOW_SYMLINKS_ANYWHERE,
+          Extension::FOLLOW_SYMLINKS_ANYWHERE | Extension::ERROR_ON_PRIVATE_KEY,
           &error_message_));
   return !!extension.get();
 }
diff --git a/chrome/browser/extensions/extension_service_unittest.cc b/chrome/browser/extensions/extension_service_unittest.cc
index 2602c11..6d2bc0e0 100644
--- a/chrome/browser/extensions/extension_service_unittest.cc
+++ b/chrome/browser/extensions/extension_service_unittest.cc
@@ -1750,6 +1750,49 @@ TEST_F(ExtensionServiceTest, PackPunctuatedExtension) {
   }
 }
 
+TEST_F(ExtensionServiceTest, PackExtensionContainingKeyFails) {
+  InitializeEmptyExtensionService();
+
+  ScopedTempDir extension_temp_dir;
+  ASSERT_TRUE(extension_temp_dir.CreateUniqueTempDir());
+  FilePath input_directory = extension_temp_dir.path().AppendASCII("ext");
+  ASSERT_TRUE(file_util::CopyDirectory(
+      data_dir_
+      .AppendASCII("good")
+      .AppendASCII("Extensions")
+      .AppendASCII("behllobkkfkfnphdnhnkndlbkcpglgmj")
+      .AppendASCII("1.0.0.0"),
+      input_directory,
+      /*recursive=*/true));
+
+  ScopedTempDir output_temp_dir;
+  ASSERT_TRUE(output_temp_dir.CreateUniqueTempDir());
+  FilePath output_directory = output_temp_dir.path();
+
+  FilePath crx_path(output_directory.AppendASCII("ex1.crx"));
+  FilePath privkey_path(output_directory.AppendASCII("privkey.pem"));
+
+  // Pack the extension once to get a private key.
+  scoped_ptr<ExtensionCreator> creator(new ExtensionCreator());
+  ASSERT_TRUE(creator->Run(input_directory, crx_path, FilePath(),
+      privkey_path, ExtensionCreator::kNoRunFlags))
+      << creator->error_message();
+  ASSERT_TRUE(file_util::PathExists(crx_path));
+  ASSERT_TRUE(file_util::PathExists(privkey_path));
+
+  file_util::Delete(crx_path, false);
+  // Move the pem file into the extension.
+  file_util::Move(privkey_path,
+                  input_directory.AppendASCII("privkey.pem"));
+
+  // This pack should fail because of the contained private key.
+  EXPECT_FALSE(creator->Run(input_directory, crx_path, FilePath(),
+      privkey_path, ExtensionCreator::kNoRunFlags));
+  EXPECT_THAT(creator->error_message(),
+              testing::ContainsRegex(
+                  "extension includes the key file.*privkey.pem"));
+}
+
 // Test Packaging and installing an extension using an openssl generated key.
 // The openssl is generated with the following:
 // > openssl genrsa -out privkey.pem 1024