filename_util_internal.cc revision 0de6073388f4e2780db8536178b129cd8f6ab386 
1// Copyright 2014 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "net/base/filename_util.h"
6
7#include "base/file_util.h"
8#include "base/files/file_path.h"
9#include "base/path_service.h"
10#include "base/strings/string_util.h"
11#include "base/strings/sys_string_conversions.h"
12#include "base/strings/utf_string_conversions.h"
13#include "base/threading/thread_restrictions.h"
14#include "net/base/escape.h"
15#include "net/base/filename_util_internal.h"
16#include "net/base/mime_util.h"
17#include "net/base/net_string_util.h"
18#include "net/http/http_content_disposition.h"
19#include "url/gurl.h"
20
21namespace net {
22
23void SanitizeGeneratedFileName(base::FilePath::StringType* filename,
24                               bool replace_trailing) {
25  const base::FilePath::CharType kReplace[] = FILE_PATH_LITERAL("-");
26  if (filename->empty())
27    return;
28  if (replace_trailing) {
29    // Handle CreateFile() stripping trailing dots and spaces on filenames
30    // http://support.microsoft.com/kb/115827
31    size_t length = filename->size();
32    size_t pos = filename->find_last_not_of(FILE_PATH_LITERAL(" ."));
33    filename->resize((pos == std::string::npos) ? 0 : (pos + 1));
34    base::TrimWhitespace(*filename, base::TRIM_TRAILING, filename);
35    if (filename->empty())
36      return;
37    size_t trimmed = length - filename->size();
38    if (trimmed)
39      filename->insert(filename->end(), trimmed, kReplace[0]);
40  }
41  base::TrimString(*filename, FILE_PATH_LITERAL("."), filename);
42  if (filename->empty())
43    return;
44  // Replace any path information by changing path separators.
45  ReplaceSubstringsAfterOffset(filename, 0, FILE_PATH_LITERAL("/"), kReplace);
46  ReplaceSubstringsAfterOffset(filename, 0, FILE_PATH_LITERAL("\\"), kReplace);
47}
48
49// Returns the filename determined from the last component of the path portion
50// of the URL.  Returns an empty string if the URL doesn't have a path or is
51// invalid. If the generated filename is not reliable,
52// |should_overwrite_extension| will be set to true, in which case a better
53// extension should be determined based on the content type.
54std::string GetFileNameFromURL(const GURL& url,
55                               const std::string& referrer_charset,
56                               bool* should_overwrite_extension) {
57  // about: and data: URLs don't have file names, but esp. data: URLs may
58  // contain parts that look like ones (i.e., contain a slash).  Therefore we
59  // don't attempt to divine a file name out of them.
60  if (!url.is_valid() || url.SchemeIs("about") || url.SchemeIs("data"))
61    return std::string();
62
63  const std::string unescaped_url_filename = UnescapeURLComponent(
64      url.ExtractFileName(),
65      UnescapeRule::SPACES | UnescapeRule::URL_SPECIAL_CHARS);
66
67  // The URL's path should be escaped UTF-8, but may not be.
68  std::string decoded_filename = unescaped_url_filename;
69  if (!base::IsStringUTF8(decoded_filename)) {
70    // TODO(jshin): this is probably not robust enough. To be sure, we need
71    // encoding detection.
72    base::string16 utf16_output;
73    if (!referrer_charset.empty() &&
74        net::ConvertToUTF16(
75            unescaped_url_filename, referrer_charset.c_str(), &utf16_output)) {
76      decoded_filename = base::UTF16ToUTF8(utf16_output);
77    } else {
78      decoded_filename =
79          base::WideToUTF8(base::SysNativeMBToWide(unescaped_url_filename));
80    }
81  }
82  // If the URL contains a (possibly empty) query, assume it is a generator, and
83  // allow the determined extension to be overwritten.
84  *should_overwrite_extension = !decoded_filename.empty() && url.has_query();
85
86  return decoded_filename;
87}
88
89// Returns whether the specified extension is automatically integrated into the
90// windows shell.
91bool IsShellIntegratedExtension(const base::FilePath::StringType& extension) {
92  base::FilePath::StringType extension_lower = StringToLowerASCII(extension);
93
94  // http://msdn.microsoft.com/en-us/library/ms811694.aspx
95  // Right-clicking on shortcuts can be magical.
96  if ((extension_lower == FILE_PATH_LITERAL("local")) ||
97      (extension_lower == FILE_PATH_LITERAL("lnk")))
98    return true;
99
100  // http://www.juniper.net/security/auto/vulnerabilities/vuln2612.html
101  // Files become magical if they end in a CLSID, so block such extensions.
102  if (!extension_lower.empty() &&
103      (extension_lower[0] == FILE_PATH_LITERAL('{')) &&
104      (extension_lower[extension_lower.length() - 1] == FILE_PATH_LITERAL('}')))
105    return true;
106  return false;
107}
108
109// Returns whether the specified file name is a reserved name on windows.
110// This includes names like "com2.zip" (which correspond to devices) and
111// desktop.ini and thumbs.db which have special meaning to the windows shell.
112bool IsReservedName(const base::FilePath::StringType& filename) {
113  // This list is taken from the MSDN article "Naming a file"
114  // http://msdn2.microsoft.com/en-us/library/aa365247(VS.85).aspx
115  // I also added clock$ because GetSaveFileName seems to consider it as a
116  // reserved name too.
117  static const char* const known_devices[] = {
118      "con",  "prn",  "aux",  "nul",  "com1", "com2", "com3",  "com4",
119      "com5", "com6", "com7", "com8", "com9", "lpt1", "lpt2",  "lpt3",
120      "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9", "clock$"};
121#if defined(OS_WIN)
122  std::string filename_lower = StringToLowerASCII(base::WideToUTF8(filename));
123#elif defined(OS_POSIX)
124  std::string filename_lower = StringToLowerASCII(filename);
125#endif
126
127  for (size_t i = 0; i < arraysize(known_devices); ++i) {
128    // Exact match.
129    if (filename_lower == known_devices[i])
130      return true;
131    // Starts with "DEVICE.".
132    if (filename_lower.find(std::string(known_devices[i]) + ".") == 0)
133      return true;
134  }
135
136  static const char* const magic_names[] = {
137    // These file names are used by the "Customize folder" feature of the shell.
138    "desktop.ini",
139    "thumbs.db",
140  };
141
142  for (size_t i = 0; i < arraysize(magic_names); ++i) {
143    if (filename_lower == magic_names[i])
144      return true;
145  }
146
147  return false;
148}
149
150// Examines the current extension in |file_name| and modifies it if necessary in
151// order to ensure the filename is safe.  If |file_name| doesn't contain an
152// extension or if |ignore_extension| is true, then a new extension will be
153// constructed based on the |mime_type|.
154//
155// We're addressing two things here:
156//
157// 1) Usability.  If there is no reliable file extension, we want to guess a
158//    reasonable file extension based on the content type.
159//
160// 2) Shell integration.  Some file extensions automatically integrate with the
161//    shell.  We block these extensions to prevent a malicious web site from
162//    integrating with the user's shell.
163void EnsureSafeExtension(const std::string& mime_type,
164                         bool ignore_extension,
165                         base::FilePath* file_name) {
166  // See if our file name already contains an extension.
167  base::FilePath::StringType extension = file_name->Extension();
168  if (!extension.empty())
169    extension.erase(extension.begin());  // Erase preceding '.'.
170
171  if ((ignore_extension || extension.empty()) && !mime_type.empty()) {
172    base::FilePath::StringType preferred_mime_extension;
173    std::vector<base::FilePath::StringType> all_mime_extensions;
174    // The GetPreferredExtensionForMimeType call will end up going to disk.  Do
175    // this on another thread to avoid slowing the IO thread.
176    // http://crbug.com/61827
177    // TODO(asanka): Remove this ScopedAllowIO once all callers have switched
178    // over to IO safe threads.
179    base::ThreadRestrictions::ScopedAllowIO allow_io;
180    net::GetPreferredExtensionForMimeType(mime_type, &preferred_mime_extension);
181    net::GetExtensionsForMimeType(mime_type, &all_mime_extensions);
182    // If the existing extension is in the list of valid extensions for the
183    // given type, use it. This avoids doing things like pointlessly renaming
184    // "foo.jpg" to "foo.jpeg".
185    if (std::find(all_mime_extensions.begin(),
186                  all_mime_extensions.end(),
187                  extension) != all_mime_extensions.end()) {
188      // leave |extension| alone
189    } else if (!preferred_mime_extension.empty()) {
190      extension = preferred_mime_extension;
191    }
192  }
193
194#if defined(OS_WIN)
195  static const base::FilePath::CharType default_extension[] =
196      FILE_PATH_LITERAL("download");
197
198  // Rename shell-integrated extensions.
199  // TODO(asanka): Consider stripping out the bad extension and replacing it
200  // with the preferred extension for the MIME type if one is available.
201  if (IsShellIntegratedExtension(extension))
202    extension.assign(default_extension);
203#endif
204
205  *file_name = file_name->ReplaceExtension(extension);
206}
207
208bool FilePathToString16(const base::FilePath& path, base::string16* converted) {
209#if defined(OS_WIN)
210  return base::WideToUTF16(
211      path.value().c_str(), path.value().size(), converted);
212#elif defined(OS_POSIX)
213  std::string component8 = path.AsUTF8Unsafe();
214  return !component8.empty() &&
215         base::UTF8ToUTF16(component8.c_str(), component8.size(), converted);
216#endif
217}
218
219base::string16 GetSuggestedFilenameImpl(
220    const GURL& url,
221    const std::string& content_disposition,
222    const std::string& referrer_charset,
223    const std::string& suggested_name,
224    const std::string& mime_type,
225    const std::string& default_name,
226    ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
227  // TODO: this function to be updated to match the httpbis recommendations.
228  // Talk to abarth for the latest news.
229
230  // We don't translate this fallback string, "download". If localization is
231  // needed, the caller should provide localized fallback in |default_name|.
232  static const base::FilePath::CharType kFinalFallbackName[] =
233      FILE_PATH_LITERAL("download");
234  std::string filename;  // In UTF-8
235  bool overwrite_extension = false;
236
237  // Try to extract a filename from content-disposition first.
238  if (!content_disposition.empty()) {
239    HttpContentDisposition header(content_disposition, referrer_charset);
240    filename = header.filename();
241  }
242
243  // Then try to use the suggested name.
244  if (filename.empty() && !suggested_name.empty())
245    filename = suggested_name;
246
247  // Now try extracting the filename from the URL.  GetFileNameFromURL() only
248  // looks at the last component of the URL and doesn't return the hostname as a
249  // failover.
250  if (filename.empty())
251    filename = GetFileNameFromURL(url, referrer_charset, &overwrite_extension);
252
253  // Finally try the URL hostname, but only if there's no default specified in
254  // |default_name|.  Some schemes (e.g.: file:, about:, data:) do not have a
255  // host name.
256  if (filename.empty() && default_name.empty() && url.is_valid() &&
257      !url.host().empty()) {
258    // TODO(jungshik) : Decode a 'punycoded' IDN hostname. (bug 1264451)
259    filename = url.host();
260  }
261
262  bool replace_trailing = false;
263  base::FilePath::StringType result_str, default_name_str;
264#if defined(OS_WIN)
265  replace_trailing = true;
266  result_str = base::UTF8ToUTF16(filename);
267  default_name_str = base::UTF8ToUTF16(default_name);
268#else
269  result_str = filename;
270  default_name_str = default_name;
271#endif
272  SanitizeGeneratedFileName(&result_str, replace_trailing);
273  if (result_str.find_last_not_of(FILE_PATH_LITERAL("-_")) ==
274      base::FilePath::StringType::npos) {
275    result_str = !default_name_str.empty()
276                     ? default_name_str
277                     : base::FilePath::StringType(kFinalFallbackName);
278    overwrite_extension = false;
279  }
280  replace_illegal_characters_callback.Run(&result_str, '-');
281  base::FilePath result(result_str);
282  GenerateSafeFileName(mime_type, overwrite_extension, &result);
283
284  base::string16 result16;
285  if (!FilePathToString16(result, &result16)) {
286    result = base::FilePath(default_name_str);
287    if (!FilePathToString16(result, &result16)) {
288      result = base::FilePath(kFinalFallbackName);
289      FilePathToString16(result, &result16);
290    }
291  }
292  return result16;
293}
294
295base::FilePath GenerateFileNameImpl(
296    const GURL& url,
297    const std::string& content_disposition,
298    const std::string& referrer_charset,
299    const std::string& suggested_name,
300    const std::string& mime_type,
301    const std::string& default_file_name,
302    ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
303  base::string16 file_name =
304      GetSuggestedFilenameImpl(url,
305                               content_disposition,
306                               referrer_charset,
307                               suggested_name,
308                               mime_type,
309                               default_file_name,
310                               replace_illegal_characters_callback);
311
312#if defined(OS_WIN)
313  base::FilePath generated_name(file_name);
314#else
315  base::FilePath generated_name(
316      base::SysWideToNativeMB(base::UTF16ToWide(file_name)));
317#endif
318
319  DCHECK(!generated_name.empty());
320
321  return generated_name;
322}
323
324}  // namespace net
325