1// Copyright (c) 2012 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#ifndef CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_ 6#define CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_ 7 8#include <string> 9 10#include "base/files/file_path.h" 11#include "base/files/scoped_temp_dir.h" 12#include "base/memory/ref_counted.h" 13#include "base/time/time.h" 14#include "content/public/browser/utility_process_host_client.h" 15#include "extensions/common/manifest.h" 16 17class SkBitmap; 18 19namespace base { 20class DictionaryValue; 21class SequencedTaskRunner; 22} 23 24namespace extensions { 25class Extension; 26 27class SandboxedUnpackerClient 28 : public base::RefCountedThreadSafe<SandboxedUnpackerClient> { 29 public: 30 // temp_dir - A temporary directory containing the results of the extension 31 // unpacking. The client is responsible for deleting this directory. 32 // 33 // extension_root - The path to the extension root inside of temp_dir. 34 // 35 // original_manifest - The parsed but unmodified version of the manifest, 36 // with no modifications such as localization, etc. 37 // 38 // extension - The extension that was unpacked. The client is responsible 39 // for deleting this memory. 40 // 41 // install_icon - The icon we will display in the installation UI, if any. 42 virtual void OnUnpackSuccess(const base::FilePath& temp_dir, 43 const base::FilePath& extension_root, 44 const base::DictionaryValue* original_manifest, 45 const Extension* extension, 46 const SkBitmap& install_icon) = 0; 47 virtual void OnUnpackFailure(const base::string16& error) = 0; 48 49 protected: 50 friend class base::RefCountedThreadSafe<SandboxedUnpackerClient>; 51 52 virtual ~SandboxedUnpackerClient() {} 53}; 54 55// SandboxedUnpacker unpacks extensions from the CRX format into a 56// directory. This is done in a sandboxed subprocess to protect the browser 57// process from parsing complex formats like JPEG or JSON from untrusted 58// sources. 59// 60// Unpacking an extension using this class makes minor changes to its source, 61// such as transcoding all images to PNG, parsing all message catalogs 62// and rewriting the manifest JSON. As such, it should not be used when the 63// output is not intended to be given back to the author. 64// 65// 66// Lifetime management: 67// 68// This class is ref-counted by each call it makes to itself on another thread, 69// and by UtilityProcessHost. 70// 71// Additionally, we hold a reference to our own client so that it lives at least 72// long enough to receive the result of unpacking. 73// 74// 75// NOTE: This class should only be used on the file thread. 76class SandboxedUnpacker : public content::UtilityProcessHostClient { 77 public: 78 // Unpacks the extension in |crx_path| into a temporary directory and calls 79 // |client| with the result. If |run_out_of_process| is provided, unpacking 80 // is done in a sandboxed subprocess. Otherwise, it is done in-process. 81 SandboxedUnpacker( 82 const base::FilePath& crx_path, 83 Manifest::Location location, 84 int creation_flags, 85 const base::FilePath& extensions_dir, 86 const scoped_refptr<base::SequencedTaskRunner>& unpacker_io_task_runner, 87 SandboxedUnpackerClient* client); 88 89 // Start unpacking the extension. The client is called with the results. 90 void Start(); 91 92 private: 93 class ProcessHostClient; 94 95 // Enumerate all the ways unpacking can fail. Calls to ReportFailure() 96 // take a failure reason as an argument, and put it in histogram 97 // Extensions.SandboxUnpackFailureReason. 98 enum FailureReason { 99 // SandboxedUnpacker::CreateTempDirectory() 100 COULD_NOT_GET_TEMP_DIRECTORY, 101 COULD_NOT_CREATE_TEMP_DIRECTORY, 102 103 // SandboxedUnpacker::Start() 104 FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY, 105 COULD_NOT_GET_SANDBOX_FRIENDLY_PATH, 106 107 // SandboxedUnpacker::OnUnpackExtensionSucceeded() 108 COULD_NOT_LOCALIZE_EXTENSION, 109 INVALID_MANIFEST, 110 111 // SandboxedUnpacker::OnUnpackExtensionFailed() 112 UNPACKER_CLIENT_FAILED, 113 114 // SandboxedUnpacker::OnProcessCrashed() 115 UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL, 116 117 // SandboxedUnpacker::ValidateSignature() 118 CRX_FILE_NOT_READABLE, 119 CRX_HEADER_INVALID, 120 CRX_MAGIC_NUMBER_INVALID, 121 CRX_VERSION_NUMBER_INVALID, 122 CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE, 123 CRX_ZERO_KEY_LENGTH, 124 CRX_ZERO_SIGNATURE_LENGTH, 125 CRX_PUBLIC_KEY_INVALID, 126 CRX_SIGNATURE_INVALID, 127 CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED, 128 CRX_SIGNATURE_VERIFICATION_FAILED, 129 130 // SandboxedUnpacker::RewriteManifestFile() 131 ERROR_SERIALIZING_MANIFEST_JSON, 132 ERROR_SAVING_MANIFEST_JSON, 133 134 // SandboxedUnpacker::RewriteImageFiles() 135 COULD_NOT_READ_IMAGE_DATA_FROM_DISK, 136 DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST, 137 INVALID_PATH_FOR_BROWSER_IMAGE, 138 ERROR_REMOVING_OLD_IMAGE_FILE, 139 INVALID_PATH_FOR_BITMAP_IMAGE, 140 ERROR_RE_ENCODING_THEME_IMAGE, 141 ERROR_SAVING_THEME_IMAGE, 142 ABORTED_DUE_TO_SHUTDOWN, 143 144 // SandboxedUnpacker::RewriteCatalogFiles() 145 COULD_NOT_READ_CATALOG_DATA_FROM_DISK, 146 INVALID_CATALOG_DATA, 147 INVALID_PATH_FOR_CATALOG, 148 ERROR_SERIALIZING_CATALOG, 149 ERROR_SAVING_CATALOG, 150 151 NUM_FAILURE_REASONS 152 }; 153 154 friend class ProcessHostClient; 155 friend class SandboxedUnpackerTest; 156 157 virtual ~SandboxedUnpacker(); 158 159 // Set |temp_dir_| as a temporary directory to unpack the extension in. 160 // Return true on success. 161 virtual bool CreateTempDirectory(); 162 163 // Validates the signature of the extension and extract the key to 164 // |public_key_|. Returns true if the signature validates, false otherwise. 165 // 166 // NOTE: Having this method here is a bit ugly. This code should really live 167 // in extensions::Unpacker as it is not specific to sandboxed unpacking. It 168 // was put here because we cannot run windows crypto code in the sandbox. But 169 // we could still have this method statically on extensions::Unpacker so that 170 // code just for unpacking is there and code just for sandboxing of unpacking 171 // is here. 172 bool ValidateSignature(); 173 174 // Starts the utility process that unpacks our extension. 175 void StartProcessOnIOThread(const base::FilePath& temp_crx_path); 176 177 // UtilityProcessHostClient 178 virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE; 179 virtual void OnProcessCrashed(int exit_code) OVERRIDE; 180 181 // IPC message handlers. 182 void OnUnpackExtensionSucceeded(const base::DictionaryValue& manifest); 183 void OnUnpackExtensionFailed(const base::string16& error_message); 184 185 void ReportFailure(FailureReason reason, const base::string16& message); 186 void ReportSuccess(const base::DictionaryValue& original_manifest, 187 const SkBitmap& install_icon); 188 189 // Overwrites original manifest with safe result from utility process. 190 // Returns NULL on error. Caller owns the returned object. 191 base::DictionaryValue* RewriteManifestFile( 192 const base::DictionaryValue& manifest); 193 194 // Overwrites original files with safe results from utility process. 195 // Reports error and returns false if it fails. 196 bool RewriteImageFiles(SkBitmap* install_icon); 197 bool RewriteCatalogFiles(); 198 199 // Cleans up temp directory artifacts. 200 void Cleanup(); 201 202 // The path to the CRX to unpack. 203 base::FilePath crx_path_; 204 205 // Our client. 206 scoped_refptr<SandboxedUnpackerClient> client_; 207 208 // The Extensions directory inside the profile. 209 base::FilePath extensions_dir_; 210 211 // A temporary directory to use for unpacking. 212 base::ScopedTempDir temp_dir_; 213 214 // The root directory of the unpacked extension. This is a child of temp_dir_. 215 base::FilePath extension_root_; 216 217 // Represents the extension we're unpacking. 218 scoped_refptr<Extension> extension_; 219 220 // Whether we've received a response from the utility process yet. 221 bool got_response_; 222 223 // The public key that was extracted from the CRX header. 224 std::string public_key_; 225 226 // The extension's ID. This will be calculated from the public key in the crx 227 // header. 228 std::string extension_id_; 229 230 // Time at which unpacking started. Used to compute the time unpacking takes. 231 base::TimeTicks unpack_start_time_; 232 233 // Location to use for the unpacked extension. 234 Manifest::Location location_; 235 236 // Creation flags to use for the extension. These flags will be used 237 // when calling Extenion::Create() by the crx installer. 238 int creation_flags_; 239 240 // Sequenced task runner where file I/O operations will be performed at. 241 scoped_refptr<base::SequencedTaskRunner> unpacker_io_task_runner_; 242}; 243 244} // namespace extensions 245 246#endif // CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_ 247