1// Copyright (c) 2011 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef CHROME_BROWSER_EXTENSIONS_SANDBOXED_EXTENSION_UNPACKER_H_
6#define CHROME_BROWSER_EXTENSIONS_SANDBOXED_EXTENSION_UNPACKER_H_
7#pragma once
8
9#include <string>
10
11#include "base/file_path.h"
12#include "base/memory/ref_counted.h"
13#include "base/memory/scoped_temp_dir.h"
14#include "chrome/browser/utility_process_host.h"
15
16class DictionaryValue;
17class Extension;
18class ResourceDispatcherHost;
19
20class SandboxedExtensionUnpackerClient
21    : public base::RefCountedThreadSafe<SandboxedExtensionUnpackerClient> {
22 public:
23  // temp_dir - A temporary directory containing the results of the extension
24  // unpacking. The client is responsible for deleting this directory.
25  //
26  // extension_root - The path to the extension root inside of temp_dir.
27  //
28  // extension - The extension that was unpacked. The client is responsible
29  // for deleting this memory.
30  virtual void OnUnpackSuccess(const FilePath& temp_dir,
31                               const FilePath& extension_root,
32                               const Extension* extension) = 0;
33  virtual void OnUnpackFailure(const std::string& error) = 0;
34
35 protected:
36  friend class base::RefCountedThreadSafe<SandboxedExtensionUnpackerClient>;
37
38  virtual ~SandboxedExtensionUnpackerClient() {}
39};
40
41// SandboxedExtensionUnpacker unpacks extensions from the CRX format into a
42// directory. This is done in a sandboxed subprocess to protect the browser
43// process from parsing complex formats like JPEG or JSON from untrusted
44// sources.
45//
46// Unpacking an extension using this class makes minor changes to its source,
47// such as transcoding all images to PNG, parsing all message catalogs
48// and rewriting the manifest JSON. As such, it should not be used when the
49// output is not intended to be given back to the author.
50//
51//
52// Lifetime management:
53//
54// This class is ref-counted by each call it makes to itself on another thread,
55// and by UtilityProcessHost.
56//
57// Additionally, we hold a reference to our own client so that it lives at least
58// long enough to receive the result of unpacking.
59//
60//
61// NOTE: This class should only be used on the file thread.
62class SandboxedExtensionUnpacker : public UtilityProcessHost::Client {
63 public:
64  // The size of the magic character sequence at the beginning of each crx
65  // file, in bytes. This should be a multiple of 4.
66  static const size_t kExtensionHeaderMagicSize = 4;
67
68  // This header is the first data at the beginning of an extension. Its
69  // contents are purposely 32-bit aligned so that it can just be slurped into
70  // a struct without manual parsing.
71  struct ExtensionHeader {
72    char magic[kExtensionHeaderMagicSize];
73    uint32 version;
74    uint32 key_size;  // The size of the public key, in bytes.
75    uint32 signature_size;  // The size of the signature, in bytes.
76    // An ASN.1-encoded PublicKeyInfo structure follows.
77    // The signature follows.
78  };
79
80  // The maximum size the crx parser will tolerate for a public key.
81  static const uint32 kMaxPublicKeySize = 1 << 16;
82
83  // The maximum size the crx parser will tolerate for a signature.
84  static const uint32 kMaxSignatureSize = 1 << 16;
85
86  // The magic character sequence at the beginning of each crx file.
87  static const char kExtensionHeaderMagic[];
88
89  // The current version of the crx format.
90  static const uint32 kCurrentVersion = 2;
91
92  // Unpacks the extension in |crx_path| into a temporary directory and calls
93  // |client| with the result. If |rdh| is provided, unpacking is done in a
94  // sandboxed subprocess. Otherwise, it is done in-process.
95  SandboxedExtensionUnpacker(const FilePath& crx_path,
96                             ResourceDispatcherHost* rdh,
97                             SandboxedExtensionUnpackerClient* cilent);
98
99  // Start unpacking the extension. The client is called with the results.
100  void Start();
101
102 private:
103  class ProcessHostClient;
104
105  // Enumerate all the ways unpacking can fail.  Calls to ReportFailure()
106  // take a failure reason as an argument, and put it in histogram
107  // Extensions.SandboxUnpackFailureReason.
108  enum FailureReason {
109    // SandboxedExtensionUnpacker::CreateTempDirectory()
110    COULD_NOT_GET_TEMP_DIRECTORY,
111    COULD_NOT_CREATE_TEMP_DIRECTORY,
112
113    // SandboxedExtensionUnpacker::Start()
114    FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY,
115    COULD_NOT_GET_SANDBOX_FRIENDLY_PATH,
116
117    // SandboxedExtensionUnpacker::OnUnpackExtensionSucceeded()
118    COULD_NOT_LOCALIZE_EXTENSION,
119    INVALID_MANIFEST,
120
121    //SandboxedExtensionUnpacker::OnUnpackExtensionFailed()
122    UNPACKER_CLIENT_FAILED,
123
124    // SandboxedExtensionUnpacker::OnProcessCrashed()
125    UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL,
126
127    // SandboxedExtensionUnpacker::ValidateSignature()
128    CRX_FILE_NOT_READABLE,
129    CRX_HEADER_INVALID,
130    CRX_MAGIC_NUMBER_INVALID,
131    CRX_VERSION_NUMBER_INVALID,
132    CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE,
133    CRX_ZERO_KEY_LENGTH,
134    CRX_ZERO_SIGNATURE_LENGTH,
135    CRX_PUBLIC_KEY_INVALID,
136    CRX_SIGNATURE_INVALID,
137    CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED,
138    CRX_SIGNATURE_VERIFICATION_FAILED,
139
140    // SandboxedExtensionUnpacker::RewriteManifestFile()
141    ERROR_SERIALIZING_MANIFEST_JSON,
142    ERROR_SAVING_MANIFEST_JSON,
143
144    // SandboxedExtensionUnpacker::RewriteImageFiles()
145    COULD_NOT_READ_IMAGE_DATA_FROM_DISK,
146    DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST,
147    INVALID_PATH_FOR_BROWSER_IMAGE,
148    ERROR_REMOVING_OLD_IMAGE_FILE,
149    INVALID_PATH_FOR_BITMAP_IMAGE,
150    ERROR_RE_ENCODING_THEME_IMAGE,
151    ERROR_SAVING_THEME_IMAGE,
152
153    // SandboxedExtensionUnpacker::RewriteCatalogFiles()
154    COULD_NOT_READ_CATALOG_DATA_FROM_DISK,
155    INVALID_CATALOG_DATA,
156    INVALID_PATH_FOR_CATALOG,
157    ERROR_SERIALIZING_CATALOG,
158    ERROR_SAVING_CATALOG,
159
160    NUM_FAILURE_REASONS
161  };
162
163  friend class ProcessHostClient;
164  friend class SandboxedExtensionUnpackerTest;
165
166  virtual ~SandboxedExtensionUnpacker();
167
168  // Set |temp_dir_| as a temporary directory to unpack the extension in.
169  // Return true on success.
170  virtual bool CreateTempDirectory();
171
172  // Validates the signature of the extension and extract the key to
173  // |public_key_|. Returns true if the signature validates, false otherwise.
174  //
175  // NOTE: Having this method here is a bit ugly. This code should really live
176  // in ExtensionUnpacker as it is not specific to sandboxed unpacking. It was
177  // put here because we cannot run windows crypto code in the sandbox. But we
178  // could still have this method statically on ExtensionUnpacker so that code
179  // just for unpacking is there and code just for sandboxing of unpacking is
180  // here.
181  bool ValidateSignature();
182
183  // Starts the utility process that unpacks our extension.
184  void StartProcessOnIOThread(const FilePath& temp_crx_path);
185
186  // SandboxedExtensionUnpacker
187  virtual void OnUnpackExtensionSucceeded(const DictionaryValue& manifest);
188  virtual void OnUnpackExtensionFailed(const std::string& error_message);
189  virtual void OnProcessCrashed(int exit_code);
190
191  void ReportFailure(FailureReason reason, const std::string& message);
192  void ReportSuccess();
193
194  // Overwrites original manifest with safe result from utility process.
195  // Returns NULL on error. Caller owns the returned object.
196  DictionaryValue* RewriteManifestFile(const DictionaryValue& manifest);
197
198  // Overwrites original files with safe results from utility process.
199  // Reports error and returns false if it fails.
200  bool RewriteImageFiles();
201  bool RewriteCatalogFiles();
202
203  // The path to the CRX to unpack.
204  FilePath crx_path_;
205
206  // Our client's thread. This is the thread we respond on.
207  BrowserThread::ID thread_identifier_;
208
209  // ResourceDispatcherHost to pass to the utility process.
210  ResourceDispatcherHost* rdh_;
211
212  // Our client.
213  scoped_refptr<SandboxedExtensionUnpackerClient> client_;
214
215  // A temporary directory to use for unpacking.
216  ScopedTempDir temp_dir_;
217
218  // The root directory of the unpacked extension. This is a child of temp_dir_.
219  FilePath extension_root_;
220
221  // Represents the extension we're unpacking.
222  scoped_refptr<Extension> extension_;
223
224  // Whether we've received a response from the utility process yet.
225  bool got_response_;
226
227  // The public key that was extracted from the CRX header.
228  std::string public_key_;
229};
230
231#endif  // CHROME_BROWSER_EXTENSIONS_SANDBOXED_EXTENSION_UNPACKER_H_
232