1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
6#define CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
7
8#include <string>
9
10#include "base/files/file_path.h"
11#include "base/files/scoped_temp_dir.h"
12#include "base/memory/ref_counted.h"
13#include "base/time/time.h"
14#include "content/public/browser/utility_process_host_client.h"
15#include "extensions/common/manifest.h"
16
17class SkBitmap;
18
19namespace base {
20class DictionaryValue;
21class SequencedTaskRunner;
22}
23
24namespace extensions {
25class Extension;
26
27class SandboxedUnpackerClient
28    : public base::RefCountedThreadSafe<SandboxedUnpackerClient> {
29 public:
30  // temp_dir - A temporary directory containing the results of the extension
31  // unpacking. The client is responsible for deleting this directory.
32  //
33  // extension_root - The path to the extension root inside of temp_dir.
34  //
35  // original_manifest - The parsed but unmodified version of the manifest,
36  // with no modifications such as localization, etc.
37  //
38  // extension - The extension that was unpacked. The client is responsible
39  // for deleting this memory.
40  //
41  // install_icon - The icon we will display in the installation UI, if any.
42  virtual void OnUnpackSuccess(const base::FilePath& temp_dir,
43                               const base::FilePath& extension_root,
44                               const base::DictionaryValue* original_manifest,
45                               const Extension* extension,
46                               const SkBitmap& install_icon) = 0;
47  virtual void OnUnpackFailure(const base::string16& error) = 0;
48
49 protected:
50  friend class base::RefCountedThreadSafe<SandboxedUnpackerClient>;
51
52  virtual ~SandboxedUnpackerClient() {}
53};
54
55// SandboxedUnpacker unpacks extensions from the CRX format into a
56// directory. This is done in a sandboxed subprocess to protect the browser
57// process from parsing complex formats like JPEG or JSON from untrusted
58// sources.
59//
60// Unpacking an extension using this class makes minor changes to its source,
61// such as transcoding all images to PNG, parsing all message catalogs
62// and rewriting the manifest JSON. As such, it should not be used when the
63// output is not intended to be given back to the author.
64//
65//
66// Lifetime management:
67//
68// This class is ref-counted by each call it makes to itself on another thread,
69// and by UtilityProcessHost.
70//
71// Additionally, we hold a reference to our own client so that it lives at least
72// long enough to receive the result of unpacking.
73//
74//
75// NOTE: This class should only be used on the file thread.
76class SandboxedUnpacker : public content::UtilityProcessHostClient {
77 public:
78  // Unpacks the extension in |crx_path| into a temporary directory and calls
79  // |client| with the result. If |run_out_of_process| is provided, unpacking
80  // is done in a sandboxed subprocess. Otherwise, it is done in-process.
81  SandboxedUnpacker(
82      const base::FilePath& crx_path,
83      Manifest::Location location,
84      int creation_flags,
85      const base::FilePath& extensions_dir,
86      const scoped_refptr<base::SequencedTaskRunner>& unpacker_io_task_runner,
87      SandboxedUnpackerClient* client);
88
89  // Start unpacking the extension. The client is called with the results.
90  void Start();
91
92 private:
93  class ProcessHostClient;
94
95  // Enumerate all the ways unpacking can fail.  Calls to ReportFailure()
96  // take a failure reason as an argument, and put it in histogram
97  // Extensions.SandboxUnpackFailureReason.
98  enum FailureReason {
99    // SandboxedUnpacker::CreateTempDirectory()
100    COULD_NOT_GET_TEMP_DIRECTORY,
101    COULD_NOT_CREATE_TEMP_DIRECTORY,
102
103    // SandboxedUnpacker::Start()
104    FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY,
105    COULD_NOT_GET_SANDBOX_FRIENDLY_PATH,
106
107    // SandboxedUnpacker::OnUnpackExtensionSucceeded()
108    COULD_NOT_LOCALIZE_EXTENSION,
109    INVALID_MANIFEST,
110
111    // SandboxedUnpacker::OnUnpackExtensionFailed()
112    UNPACKER_CLIENT_FAILED,
113
114    // SandboxedUnpacker::OnProcessCrashed()
115    UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL,
116
117    // SandboxedUnpacker::ValidateSignature()
118    CRX_FILE_NOT_READABLE,
119    CRX_HEADER_INVALID,
120    CRX_MAGIC_NUMBER_INVALID,
121    CRX_VERSION_NUMBER_INVALID,
122    CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE,
123    CRX_ZERO_KEY_LENGTH,
124    CRX_ZERO_SIGNATURE_LENGTH,
125    CRX_PUBLIC_KEY_INVALID,
126    CRX_SIGNATURE_INVALID,
127    CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED,
128    CRX_SIGNATURE_VERIFICATION_FAILED,
129
130    // SandboxedUnpacker::RewriteManifestFile()
131    ERROR_SERIALIZING_MANIFEST_JSON,
132    ERROR_SAVING_MANIFEST_JSON,
133
134    // SandboxedUnpacker::RewriteImageFiles()
135    COULD_NOT_READ_IMAGE_DATA_FROM_DISK,
136    DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST,
137    INVALID_PATH_FOR_BROWSER_IMAGE,
138    ERROR_REMOVING_OLD_IMAGE_FILE,
139    INVALID_PATH_FOR_BITMAP_IMAGE,
140    ERROR_RE_ENCODING_THEME_IMAGE,
141    ERROR_SAVING_THEME_IMAGE,
142    ABORTED_DUE_TO_SHUTDOWN,
143
144    // SandboxedUnpacker::RewriteCatalogFiles()
145    COULD_NOT_READ_CATALOG_DATA_FROM_DISK,
146    INVALID_CATALOG_DATA,
147    INVALID_PATH_FOR_CATALOG,
148    ERROR_SERIALIZING_CATALOG,
149    ERROR_SAVING_CATALOG,
150
151    NUM_FAILURE_REASONS
152  };
153
154  friend class ProcessHostClient;
155  friend class SandboxedUnpackerTest;
156
157  virtual ~SandboxedUnpacker();
158
159  // Set |temp_dir_| as a temporary directory to unpack the extension in.
160  // Return true on success.
161  virtual bool CreateTempDirectory();
162
163  // Validates the signature of the extension and extract the key to
164  // |public_key_|. Returns true if the signature validates, false otherwise.
165  //
166  // NOTE: Having this method here is a bit ugly. This code should really live
167  // in extensions::Unpacker as it is not specific to sandboxed unpacking. It
168  // was put here because we cannot run windows crypto code in the sandbox. But
169  // we could still have this method statically on extensions::Unpacker so that
170  // code just for unpacking is there and code just for sandboxing of unpacking
171  // is here.
172  bool ValidateSignature();
173
174  // Starts the utility process that unpacks our extension.
175  void StartProcessOnIOThread(const base::FilePath& temp_crx_path);
176
177  // UtilityProcessHostClient
178  virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
179  virtual void OnProcessCrashed(int exit_code) OVERRIDE;
180
181  // IPC message handlers.
182  void OnUnpackExtensionSucceeded(const base::DictionaryValue& manifest);
183  void OnUnpackExtensionFailed(const base::string16& error_message);
184
185  void ReportFailure(FailureReason reason, const base::string16& message);
186  void ReportSuccess(const base::DictionaryValue& original_manifest,
187                     const SkBitmap& install_icon);
188
189  // Overwrites original manifest with safe result from utility process.
190  // Returns NULL on error. Caller owns the returned object.
191  base::DictionaryValue* RewriteManifestFile(
192      const base::DictionaryValue& manifest);
193
194  // Overwrites original files with safe results from utility process.
195  // Reports error and returns false if it fails.
196  bool RewriteImageFiles(SkBitmap* install_icon);
197  bool RewriteCatalogFiles();
198
199  // Cleans up temp directory artifacts.
200  void Cleanup();
201
202  // The path to the CRX to unpack.
203  base::FilePath crx_path_;
204
205  // Our client.
206  scoped_refptr<SandboxedUnpackerClient> client_;
207
208  // The Extensions directory inside the profile.
209  base::FilePath extensions_dir_;
210
211  // A temporary directory to use for unpacking.
212  base::ScopedTempDir temp_dir_;
213
214  // The root directory of the unpacked extension. This is a child of temp_dir_.
215  base::FilePath extension_root_;
216
217  // Represents the extension we're unpacking.
218  scoped_refptr<Extension> extension_;
219
220  // Whether we've received a response from the utility process yet.
221  bool got_response_;
222
223  // The public key that was extracted from the CRX header.
224  std::string public_key_;
225
226  // The extension's ID. This will be calculated from the public key in the crx
227  // header.
228  std::string extension_id_;
229
230  // Time at which unpacking started. Used to compute the time unpacking takes.
231  base::TimeTicks unpack_start_time_;
232
233  // Location to use for the unpacked extension.
234  Manifest::Location location_;
235
236  // Creation flags to use for the extension.  These flags will be used
237  // when calling Extenion::Create() by the crx installer.
238  int creation_flags_;
239
240  // Sequenced task runner where file I/O operations will be performed at.
241  scoped_refptr<base::SequencedTaskRunner> unpacker_io_task_runner_;
242};
243
244}  // namespace extensions
245
246#endif  // CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
247