1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
// Copyright (c) 2009 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef CHROME_BROWSER_EXTENSIONS_SANDBOXED_EXTENSION_UNPACKER_H_
#define CHROME_BROWSER_EXTENSIONS_SANDBOXED_EXTENSION_UNPACKER_H_
#include <string>
#include "base/file_path.h"
#include "base/ref_counted.h"
#include "base/scoped_temp_dir.h"
#include "base/values.h"
#include "chrome/browser/utility_process_host.h"
class Extension;
class MessageLoop;
class ResourceDispatcherHost;
class SandboxedExtensionUnpackerClient
: public base::RefCountedThreadSafe<SandboxedExtensionUnpackerClient> {
public:
// temp_dir - A temporary directoy containing the results of the extension
// unpacking. The client is responsible for deleting this directory.
//
// extension_root - The path to the extension root inside of temp_dir.
//
// extension - The extension that was unpacked. The client is responsible
// for deleting this memory.
virtual void OnUnpackSuccess(const FilePath& temp_dir,
const FilePath& extension_root,
Extension* extension) = 0;
virtual void OnUnpackFailure(const std::string& error) = 0;
protected:
friend class base::RefCountedThreadSafe<SandboxedExtensionUnpackerClient>;
virtual ~SandboxedExtensionUnpackerClient() {}
};
// SandboxedExtensionUnpacker unpacks extensions from the CRX format into a
// directory. This is done in a sandboxed subprocess to protect the browser
// process from parsing complex formats like JPEG or JSON from untrusted
// sources.
//
// Unpacking an extension using this class makes minor changes to its source,
// such as transcoding all images to PNG and rewriting the manifest JSON. As
// such, it should not be used when the output is not intended to be given back
// to the author.
//
//
// Lifetime management:
//
// This class is ref-counted by each call it makes to itself on another thread,
// and by UtilityProcessHost.
//
// Additionally, we hold a reference to our own client so that it lives at least
// long enough to receive the result of unpacking.
//
//
// NOTE: This class should only be used on the file thread.
class SandboxedExtensionUnpacker : public UtilityProcessHost::Client {
public:
// The size of the magic character sequence at the beginning of each crx
// file, in bytes. This should be a multiple of 4.
static const size_t kExtensionHeaderMagicSize = 4;
// This header is the first data at the beginning of an extension. Its
// contents are purposely 32-bit aligned so that it can just be slurped into
// a struct without manual parsing.
struct ExtensionHeader {
char magic[kExtensionHeaderMagicSize];
uint32 version;
uint32 key_size; // The size of the public key, in bytes.
uint32 signature_size; // The size of the signature, in bytes.
// An ASN.1-encoded PublicKeyInfo structure follows.
// The signature follows.
};
// The maximum size the crx parser will tolerate for a public key.
static const uint32 kMaxPublicKeySize = 1 << 16;
// The maximum size the crx parser will tolerate for a signature.
static const uint32 kMaxSignatureSize = 1 << 16;
// The magic character sequence at the beginning of each crx file.
static const char kExtensionHeaderMagic[];
// The current version of the crx format.
static const uint32 kCurrentVersion = 2;
// Unpacks the extension in |crx_path| into a temporary directory and calls
// |client| with the result. If |rdh| is provided, unpacking is done in a
// sandboxed subprocess. Otherwise, it is done in-process.
SandboxedExtensionUnpacker(const FilePath& crx_path,
ResourceDispatcherHost* rdh,
SandboxedExtensionUnpackerClient* cilent);
// Start unpacking the extension. The client is called with the results.
void Start();
private:
class ProcessHostClient;
friend class ProcessHostClient;
~SandboxedExtensionUnpacker() {}
// Validates the signature of the extension and extract the key to
// |public_key_|. Returns true if the signature validates, false otherwise.
//
// NOTE: Having this method here is a bit ugly. This code should really live
// in ExtensionUnpacker as it is not specific to sandboxed unpacking. It was
// put here because we cannot run windows crypto code in the sandbox. But we
// could still have this method statically on ExtensionUnpacker so that code
// just for unpacking is there and code just for sandboxing of unpacking is
// here.
bool ValidateSignature();
// Starts the utility process that unpacks our extension.
void StartProcessOnIOThread(const FilePath& temp_crx_path);
// SandboxedExtensionUnpacker
void OnUnpackExtensionSucceeded(const DictionaryValue& manifest);
void OnUnpackExtensionFailed(const std::string& error_message);
void OnProcessCrashed();
void ReportFailure(const std::string& message);
void ReportSuccess();
FilePath crx_path_;
ChromeThread::ID thread_identifier_;
ResourceDispatcherHost* rdh_;
scoped_refptr<SandboxedExtensionUnpackerClient> client_;
ScopedTempDir temp_dir_;
FilePath extension_root_;
scoped_ptr<Extension> extension_;
bool got_response_;
std::string public_key_;
};
#endif // CHROME_BROWSER_EXTENSIONS_SANDBOXED_EXTENSION_UNPACKER_H_
|
