extensions/browser/sandboxed_unpacker.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "extensions/browser/sandboxed_unpacker.h"
   6
   7 #include <set>
   8
   9 #include "base/base64.h"
  10 #include "base/bind.h"
  11 #include "base/command_line.h"
  12 #include "base/files/file_util.h"
  13 #include "base/files/file_util_proxy.h"
  14 #include "base/files/scoped_file.h"
  15 #include "base/json/json_string_value_serializer.h"
  16 #include "base/message_loop/message_loop.h"
  17 #include "base/metrics/histogram.h"
  18 #include "base/numerics/safe_conversions.h"
  19 #include "base/path_service.h"
  20 #include "base/sequenced_task_runner.h"
  21 #include "base/strings/string_number_conversions.h"
  22 #include "base/strings/utf_string_conversions.h"
  23 #include "base/threading/sequenced_worker_pool.h"
  24 #include "components/crx_file/constants.h"
  25 #include "components/crx_file/crx_file.h"
  26 #include "components/crx_file/id_util.h"
  27 #include "content/public/browser/browser_thread.h"
  28 #include "content/public/browser/utility_process_host.h"
  29 #include "content/public/common/common_param_traits.h"
  30 #include "crypto/secure_hash.h"
  31 #include "crypto/sha2.h"
  32 #include "crypto/signature_verifier.h"
  33 #include "extensions/common/constants.h"
  34 #include "extensions/common/extension.h"
  35 #include "extensions/common/extension_l10n_util.h"
  36 #include "extensions/common/extension_utility_messages.h"
  37 #include "extensions/common/extensions_client.h"
  38 #include "extensions/common/file_util.h"
  39 #include "extensions/common/manifest_constants.h"
  40 #include "extensions/common/manifest_handlers/icons_handler.h"
  41 #include "extensions/common/switches.h"
  42 #include "grit/extensions_strings.h"
  43 #include "third_party/skia/include/core/SkBitmap.h"
  44 #include "ui/base/l10n/l10n_util.h"
  45 #include "ui/gfx/codec/png_codec.h"
  46
  47 using base::ASCIIToUTF16;
  48 using content::BrowserThread;
  49 using content::UtilityProcessHost;
  50 using crx_file::CrxFile;
  51
  52 // The following macro makes histograms that record the length of paths
  53 // in this file much easier to read.
  54 // Windows has a short max path length. If the path length to a
  55 // file being unpacked from a CRX exceeds the max length, we might
  56 // fail to install. To see if this is happening, see how long the
  57 // path to the temp unpack directory is. See crbug.com/69693 .
  58 #define PATH_LENGTH_HISTOGRAM(name, path) \
  59   UMA_HISTOGRAM_CUSTOM_COUNTS(name, path.value().length(), 0, 500, 100)
  60
  61 // Record a rate (kB per second) at which extensions are unpacked.
  62 // Range from 1kB/s to 100mB/s.
  63 #define UNPACK_RATE_HISTOGRAM(name, rate) \
  64   UMA_HISTOGRAM_CUSTOM_COUNTS(name, rate, 1, 100000, 100);
  65
  66 namespace extensions {
  67 namespace {
  68
  69 void RecordSuccessfulUnpackTimeHistograms(const base::FilePath& crx_path,
  70                                           const base::TimeDelta unpack_time) {
  71   const int64 kBytesPerKb = 1024;
  72   const int64 kBytesPerMb = 1024 * 1024;
  73
  74   UMA_HISTOGRAM_TIMES("Extensions.SandboxUnpackSuccessTime", unpack_time);
  75
  76   // To get a sense of how CRX size impacts unpack time, record unpack
  77   // time for several increments of CRX size.
  78   int64 crx_file_size;
  79   if (!base::GetFileSize(crx_path, &crx_file_size)) {
  80     UMA_HISTOGRAM_COUNTS("Extensions.SandboxUnpackSuccessCantGetCrxSize", 1);
  81     return;
  82   }
  83
  84   // Cast is safe as long as the number of bytes in the CRX is less than
  85   // 2^31 * 2^10.
  86   int crx_file_size_kb = static_cast<int>(crx_file_size / kBytesPerKb);
  87   UMA_HISTOGRAM_COUNTS("Extensions.SandboxUnpackSuccessCrxSize",
  88                        crx_file_size_kb);
  89
  90   // We have time in seconds and file size in bytes.  We want the rate bytes are
  91   // unpacked in kB/s.
  92   double file_size_kb =
  93       static_cast<double>(crx_file_size) / static_cast<double>(kBytesPerKb);
  94   int unpack_rate_kb_per_s =
  95       static_cast<int>(file_size_kb / unpack_time.InSecondsF());
  96   UNPACK_RATE_HISTOGRAM("Extensions.SandboxUnpackRate", unpack_rate_kb_per_s);
  97
  98   if (crx_file_size < 50.0 * kBytesPerKb) {
  99     UNPACK_RATE_HISTOGRAM("Extensions.SandboxUnpackRateUnder50kB",
 100                           unpack_rate_kb_per_s);
 101
 102   } else if (crx_file_size < 1 * kBytesPerMb) {
 103     UNPACK_RATE_HISTOGRAM("Extensions.SandboxUnpackRate50kBTo1mB",
 104                           unpack_rate_kb_per_s);
 105
 106   } else if (crx_file_size < 2 * kBytesPerMb) {
 107     UNPACK_RATE_HISTOGRAM("Extensions.SandboxUnpackRate1To2mB",
 108                           unpack_rate_kb_per_s);
 109
 110   } else if (crx_file_size < 5 * kBytesPerMb) {
 111     UNPACK_RATE_HISTOGRAM("Extensions.SandboxUnpackRate2To5mB",
 112                           unpack_rate_kb_per_s);
 113
 114   } else if (crx_file_size < 10 * kBytesPerMb) {
 115     UNPACK_RATE_HISTOGRAM("Extensions.SandboxUnpackRate5To10mB",
 116                           unpack_rate_kb_per_s);
 117
 118   } else {
 119     UNPACK_RATE_HISTOGRAM("Extensions.SandboxUnpackRateOver10mB",
 120                           unpack_rate_kb_per_s);
 121   }
 122 }
 123
 124 // Work horse for FindWritableTempLocation. Creates a temp file in the folder
 125 // and uses NormalizeFilePath to check if the path is junction free.
 126 bool VerifyJunctionFreeLocation(base::FilePath* temp_dir) {
 127   if (temp_dir->empty())
 128     return false;
 129
 130   base::FilePath temp_file;
 131   if (!base::CreateTemporaryFileInDir(*temp_dir, &temp_file)) {
 132     LOG(ERROR) << temp_dir->value() << " is not writable";
 133     return false;
 134   }
 135   // NormalizeFilePath requires a non-empty file, so write some data.
 136   // If you change the exit points of this function please make sure all
 137   // exit points delete this temp file!
 138   if (base::WriteFile(temp_file, ".", 1) != 1)
 139     return false;
 140
 141   base::FilePath normalized_temp_file;
 142   bool normalized = base::NormalizeFilePath(temp_file, &normalized_temp_file);
 143   if (!normalized) {
 144     // If |temp_file| contains a link, the sandbox will block al file system
 145     // operations, and the install will fail.
 146     LOG(ERROR) << temp_dir->value() << " seem to be on remote drive.";
 147   } else {
 148     *temp_dir = normalized_temp_file.DirName();
 149   }
 150   // Clean up the temp file.
 151   base::DeleteFile(temp_file, false);
 152
 153   return normalized;
 154 }
 155
 156 // This function tries to find a location for unpacking the extension archive
 157 // that is writable and does not lie on a shared drive so that the sandboxed
 158 // unpacking process can write there. If no such location exists we can not
 159 // proceed and should fail.
 160 // The result will be written to |temp_dir|. The function will write to this
 161 // parameter even if it returns false.
 162 bool FindWritableTempLocation(const base::FilePath& extensions_dir,
 163                               base::FilePath* temp_dir) {
 164 // On ChromeOS, we will only attempt to unpack extension in cryptohome (profile)
 165 // directory to provide additional security/privacy and speed up the rest of
 166 // the extension install process.
 167 #if !defined(OS_CHROMEOS)
 168   PathService::Get(base::DIR_TEMP, temp_dir);
 169   if (VerifyJunctionFreeLocation(temp_dir))
 170     return true;
 171 #endif
 172
 173   *temp_dir = file_util::GetInstallTempDir(extensions_dir);
 174   if (VerifyJunctionFreeLocation(temp_dir))
 175     return true;
 176   // Neither paths is link free chances are good installation will fail.
 177   LOG(ERROR) << "Both the %TEMP% folder and the profile seem to be on "
 178              << "remote drives or read-only. Installation can not complete!";
 179   return false;
 180 }
 181
 182 // Read the decoded images back from the file we saved them to.
 183 // |extension_path| is the path to the extension we unpacked that wrote the
 184 // data. Returns true on success.
 185 bool ReadImagesFromFile(const base::FilePath& extension_path,
 186                         DecodedImages* images) {
 187   base::FilePath path = extension_path.AppendASCII(kDecodedImagesFilename);
 188   std::string file_str;
 189   if (!base::ReadFileToString(path, &file_str))
 190     return false;
 191
 192   IPC::Message pickle(file_str.data(), file_str.size());
 193   PickleIterator iter(pickle);
 194   return IPC::ReadParam(&pickle, &iter, images);
 195 }
 196
 197 // Read the decoded message catalogs back from the file we saved them to.
 198 // |extension_path| is the path to the extension we unpacked that wrote the
 199 // data. Returns true on success.
 200 bool ReadMessageCatalogsFromFile(const base::FilePath& extension_path,
 201                                  base::DictionaryValue* catalogs) {
 202   base::FilePath path =
 203       extension_path.AppendASCII(kDecodedMessageCatalogsFilename);
 204   std::string file_str;
 205   if (!base::ReadFileToString(path, &file_str))
 206     return false;
 207
 208   IPC::Message pickle(file_str.data(), file_str.size());
 209   PickleIterator iter(pickle);
 210   return IPC::ReadParam(&pickle, &iter, catalogs);
 211 }
 212
 213 }  // namespace
 214
 215 SandboxedUnpacker::SandboxedUnpacker(
 216     const CRXFileInfo& file,
 217     Manifest::Location location,
 218     int creation_flags,
 219     const base::FilePath& extensions_dir,
 220     const scoped_refptr<base::SequencedTaskRunner>& unpacker_io_task_runner,
 221     SandboxedUnpackerClient* client)
 222     : crx_path_(file.path),
 223       package_hash_(base::StringToLowerASCII(file.expected_hash)),
 224       check_crx_hash_(false),
 225       client_(client),
 226       extensions_dir_(extensions_dir),
 227       got_response_(false),
 228       location_(location),
 229       creation_flags_(creation_flags),
 230       unpacker_io_task_runner_(unpacker_io_task_runner) {
 231   if (!package_hash_.empty()) {
 232     check_crx_hash_ = base::CommandLine::ForCurrentProcess()->HasSwitch(
 233         extensions::switches::kEnableCrxHashCheck);
 234   }
 235 }
 236
 237 bool SandboxedUnpacker::CreateTempDirectory() {
 238   CHECK(unpacker_io_task_runner_->RunsTasksOnCurrentThread());
 239
 240   base::FilePath temp_dir;
 241   if (!FindWritableTempLocation(extensions_dir_, &temp_dir)) {
 242     ReportFailure(COULD_NOT_GET_TEMP_DIRECTORY,
 243                   l10n_util::GetStringFUTF16(
 244                       IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 245                       ASCIIToUTF16("COULD_NOT_GET_TEMP_DIRECTORY")));
 246     return false;
 247   }
 248
 249   if (!temp_dir_.CreateUniqueTempDirUnderPath(temp_dir)) {
 250     ReportFailure(COULD_NOT_CREATE_TEMP_DIRECTORY,
 251                   l10n_util::GetStringFUTF16(
 252                       IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 253                       ASCIIToUTF16("COULD_NOT_CREATE_TEMP_DIRECTORY")));
 254     return false;
 255   }
 256
 257   return true;
 258 }
 259
 260 void SandboxedUnpacker::Start() {
 261   // We assume that we are started on the thread that the client wants us to do
 262   // file IO on.
 263   CHECK(unpacker_io_task_runner_->RunsTasksOnCurrentThread());
 264
 265   unpack_start_time_ = base::TimeTicks::Now();
 266
 267   PATH_LENGTH_HISTOGRAM("Extensions.SandboxUnpackInitialCrxPathLength",
 268                         crx_path_);
 269   if (!CreateTempDirectory())
 270     return;  // ReportFailure() already called.
 271
 272   // Initialize the path that will eventually contain the unpacked extension.
 273   extension_root_ = temp_dir_.path().AppendASCII(kTempExtensionName);
 274   PATH_LENGTH_HISTOGRAM("Extensions.SandboxUnpackUnpackedCrxPathLength",
 275                         extension_root_);
 276
 277   // Extract the public key and validate the package.
 278   if (!ValidateSignature())
 279     return;  // ValidateSignature() already reported the error.
 280
 281   // Copy the crx file into our working directory.
 282   base::FilePath temp_crx_path = temp_dir_.path().Append(crx_path_.BaseName());
 283   PATH_LENGTH_HISTOGRAM("Extensions.SandboxUnpackTempCrxPathLength",
 284                         temp_crx_path);
 285
 286   if (!base::CopyFile(crx_path_, temp_crx_path)) {
 287     // Failed to copy extension file to temporary directory.
 288     ReportFailure(
 289         FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY,
 290         l10n_util::GetStringFUTF16(
 291             IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 292             ASCIIToUTF16("FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY")));
 293     return;
 294   }
 295
 296   // The utility process will have access to the directory passed to
 297   // SandboxedUnpacker.  That directory should not contain a symlink or NTFS
 298   // reparse point.  When the path is used, following the link/reparse point
 299   // will cause file system access outside the sandbox path, and the sandbox
 300   // will deny the operation.
 301   base::FilePath link_free_crx_path;
 302   if (!base::NormalizeFilePath(temp_crx_path, &link_free_crx_path)) {
 303     LOG(ERROR) << "Could not get the normalized path of "
 304                << temp_crx_path.value();
 305     ReportFailure(COULD_NOT_GET_SANDBOX_FRIENDLY_PATH,
 306                   l10n_util::GetStringUTF16(IDS_EXTENSION_UNPACK_FAILED));
 307     return;
 308   }
 309   PATH_LENGTH_HISTOGRAM("Extensions.SandboxUnpackLinkFreeCrxPathLength",
 310                         link_free_crx_path);
 311
 312   BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
 313                           base::Bind(&SandboxedUnpacker::StartProcessOnIOThread,
 314                                      this, link_free_crx_path));
 315 }
 316
 317 SandboxedUnpacker::~SandboxedUnpacker() {
 318 }
 319
 320 bool SandboxedUnpacker::OnMessageReceived(const IPC::Message& message) {
 321   bool handled = true;
 322   IPC_BEGIN_MESSAGE_MAP(SandboxedUnpacker, message)
 323   IPC_MESSAGE_HANDLER(ChromeUtilityHostMsg_UnpackExtension_Succeeded,
 324                       OnUnpackExtensionSucceeded)
 325   IPC_MESSAGE_HANDLER(ChromeUtilityHostMsg_UnpackExtension_Failed,
 326                       OnUnpackExtensionFailed)
 327   IPC_MESSAGE_UNHANDLED(handled = false)
 328   IPC_END_MESSAGE_MAP()
 329   return handled;
 330 }
 331
 332 void SandboxedUnpacker::OnProcessCrashed(int exit_code) {
 333   // Don't report crashes if they happen after we got a response.
 334   if (got_response_)
 335     return;
 336
 337   // Utility process crashed while trying to install.
 338   ReportFailure(
 339       UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL,
 340       l10n_util::GetStringFUTF16(
 341           IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 342           ASCIIToUTF16("UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL")) +
 343           ASCIIToUTF16(". ") +
 344           l10n_util::GetStringUTF16(IDS_EXTENSION_INSTALL_PROCESS_CRASHED));
 345 }
 346
 347 void SandboxedUnpacker::StartProcessOnIOThread(
 348     const base::FilePath& temp_crx_path) {
 349   UtilityProcessHost* host =
 350       UtilityProcessHost::Create(this, unpacker_io_task_runner_.get());
 351   host->SetName(
 352       l10n_util::GetStringUTF16(IDS_UTILITY_PROCESS_EXTENSION_UNPACKER_NAME));
 353   // Grant the subprocess access to the entire subdir the extension file is
 354   // in, so that it can unpack to that dir.
 355   host->SetExposedDir(temp_crx_path.DirName());
 356   host->Send(new ChromeUtilityMsg_UnpackExtension(temp_crx_path, extension_id_,
 357                                                   location_, creation_flags_));
 358 }
 359
 360 void SandboxedUnpacker::OnUnpackExtensionSucceeded(
 361     const base::DictionaryValue& manifest) {
 362   CHECK(unpacker_io_task_runner_->RunsTasksOnCurrentThread());
 363   got_response_ = true;
 364
 365   scoped_ptr<base::DictionaryValue> final_manifest(
 366       RewriteManifestFile(manifest));
 367   if (!final_manifest)
 368     return;
 369
 370   // Create an extension object that refers to the temporary location the
 371   // extension was unpacked to. We use this until the extension is finally
 372   // installed. For example, the install UI shows images from inside the
 373   // extension.
 374
 375   // Localize manifest now, so confirm UI gets correct extension name.
 376
 377   // TODO(rdevlin.cronin): Continue removing std::string errors and replacing
 378   // with base::string16
 379   std::string utf8_error;
 380   if (!extension_l10n_util::LocalizeExtension(
 381           extension_root_, final_manifest.get(), &utf8_error)) {
 382     ReportFailure(
 383         COULD_NOT_LOCALIZE_EXTENSION,
 384         l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_ERROR_MESSAGE,
 385                                    base::UTF8ToUTF16(utf8_error)));
 386     return;
 387   }
 388
 389   extension_ =
 390       Extension::Create(extension_root_, location_, *final_manifest,
 391                         Extension::REQUIRE_KEY | creation_flags_, &utf8_error);
 392
 393   if (!extension_.get()) {
 394     ReportFailure(INVALID_MANIFEST,
 395                   ASCIIToUTF16("Manifest is invalid: " + utf8_error));
 396     return;
 397   }
 398
 399   SkBitmap install_icon;
 400   if (!RewriteImageFiles(&install_icon))
 401     return;
 402
 403   if (!RewriteCatalogFiles())
 404     return;
 405
 406   ReportSuccess(manifest, install_icon);
 407 }
 408
 409 void SandboxedUnpacker::OnUnpackExtensionFailed(const base::string16& error) {
 410   CHECK(unpacker_io_task_runner_->RunsTasksOnCurrentThread());
 411   got_response_ = true;
 412   ReportFailure(
 413       UNPACKER_CLIENT_FAILED,
 414       l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_ERROR_MESSAGE, error));
 415 }
 416
 417 static size_t ReadAndHash(void* ptr,
 418                           size_t size,
 419                           size_t nmemb,
 420                           FILE* stream,
 421                           scoped_ptr<crypto::SecureHash>& hash) {
 422   size_t len = fread(ptr, size, nmemb, stream);
 423   if (len > 0 && hash) {
 424     hash->Update(ptr, len * size);
 425   }
 426   return len;
 427 }
 428
 429 bool SandboxedUnpacker::FinalizeHash(scoped_ptr<crypto::SecureHash>& hash) {
 430   if (hash) {
 431     uint8 output[crypto::kSHA256Length];
 432     hash->Finish(output, sizeof(output));
 433     std::string real_hash =
 434         base::StringToLowerASCII(base::HexEncode(output, sizeof(output)));
 435     bool result = (real_hash == package_hash_);
 436     UMA_HISTOGRAM_BOOLEAN("Extensions.SandboxUnpackHashCheck", result);
 437     if (!result && check_crx_hash_) {
 438       // Package hash verification failed
 439       LOG(ERROR) << "Hash check failed for extension: " << extension_id_
 440                  << ", expected " << package_hash_ << ", got " << real_hash;
 441       ReportFailure(CRX_HASH_VERIFICATION_FAILED,
 442                     l10n_util::GetStringFUTF16(
 443                         IDS_EXTENSION_PACKAGE_ERROR_CODE,
 444                         ASCIIToUTF16("CRX_HASH_VERIFICATION_FAILED")));
 445       return false;
 446     }
 447   }
 448
 449   return true;
 450 }
 451
 452 bool SandboxedUnpacker::ValidateSignature() {
 453   base::ScopedFILE file(base::OpenFile(crx_path_, "rb"));
 454
 455   scoped_ptr<crypto::SecureHash> hash;
 456
 457   if (!package_hash_.empty()) {
 458     hash.reset(crypto::SecureHash::Create(crypto::SecureHash::SHA256));
 459   }
 460
 461   if (!file.get()) {
 462 // Could not open crx file for reading.
 463 #if defined(OS_WIN)
 464     // On windows, get the error code.
 465     uint32 error_code = ::GetLastError();
 466     // TODO(skerner): Use this histogram to understand why so many
 467     // windows users hit this error.  crbug.com/69693
 468
 469     // Windows errors are unit32s, but all of likely errors are in
 470     // [1, 1000].  See winerror.h for the meaning of specific values.
 471     // Clip errors outside the expected range to a single extra value.
 472     // If there are errors in that extra bucket, we will know to expand
 473     // the range.
 474     const uint32 kMaxErrorToSend = 1001;
 475     error_code = std::min(error_code, kMaxErrorToSend);
 476     UMA_HISTOGRAM_ENUMERATION("Extensions.ErrorCodeFromCrxOpen", error_code,
 477                               kMaxErrorToSend);
 478 #endif
 479
 480     ReportFailure(
 481         CRX_FILE_NOT_READABLE,
 482         l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_ERROR_CODE,
 483                                    ASCIIToUTF16("CRX_FILE_NOT_READABLE")));
 484     return false;
 485   }
 486
 487   // Read and verify the header.
 488   // TODO(erikkay): Yuck.  I'm not a big fan of this kind of code, but it
 489   // appears that we don't have any endian/alignment aware serialization
 490   // code in the code base.  So for now, this assumes that we're running
 491   // on a little endian machine with 4 byte alignment.
 492   CrxFile::Header header;
 493   size_t len = ReadAndHash(&header, 1, sizeof(header), file.get(), hash);
 494   if (len < sizeof(header)) {
 495     // Invalid crx header
 496     ReportFailure(CRX_HEADER_INVALID, l10n_util::GetStringFUTF16(
 497                                           IDS_EXTENSION_PACKAGE_ERROR_CODE,
 498                                           ASCIIToUTF16("CRX_HEADER_INVALID")));
 499     return false;
 500   }
 501
 502   CrxFile::Error error;
 503   scoped_ptr<CrxFile> crx(CrxFile::Parse(header, &error));
 504   if (!crx) {
 505     switch (error) {
 506       case CrxFile::kWrongMagic:
 507         ReportFailure(CRX_MAGIC_NUMBER_INVALID,
 508                       l10n_util::GetStringFUTF16(
 509                           IDS_EXTENSION_PACKAGE_ERROR_CODE,
 510                           ASCIIToUTF16("CRX_MAGIC_NUMBER_INVALID")));
 511         break;
 512       case CrxFile::kInvalidVersion:
 513         // Bad version numer
 514         ReportFailure(CRX_VERSION_NUMBER_INVALID,
 515                       l10n_util::GetStringFUTF16(
 516                           IDS_EXTENSION_PACKAGE_ERROR_CODE,
 517                           ASCIIToUTF16("CRX_VERSION_NUMBER_INVALID")));
 518         break;
 519       case CrxFile::kInvalidKeyTooLarge:
 520       case CrxFile::kInvalidSignatureTooLarge:
 521         // Excessively large key or signature
 522         ReportFailure(
 523             CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE,
 524             l10n_util::GetStringFUTF16(
 525                 IDS_EXTENSION_PACKAGE_ERROR_CODE,
 526                 ASCIIToUTF16("CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE")));
 527         break;
 528       case CrxFile::kInvalidKeyTooSmall:
 529         // Key length is zero
 530         ReportFailure(
 531             CRX_ZERO_KEY_LENGTH,
 532             l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_ERROR_CODE,
 533                                        ASCIIToUTF16("CRX_ZERO_KEY_LENGTH")));
 534         break;
 535       case CrxFile::kInvalidSignatureTooSmall:
 536         // Signature length is zero
 537         ReportFailure(CRX_ZERO_SIGNATURE_LENGTH,
 538                       l10n_util::GetStringFUTF16(
 539                           IDS_EXTENSION_PACKAGE_ERROR_CODE,
 540                           ASCIIToUTF16("CRX_ZERO_SIGNATURE_LENGTH")));
 541         break;
 542     }
 543     return false;
 544   }
 545
 546   std::vector<uint8> key;
 547   key.resize(header.key_size);
 548   len = ReadAndHash(&key.front(), sizeof(uint8), header.key_size, file.get(),
 549                     hash);
 550   if (len < header.key_size) {
 551     // Invalid public key
 552     ReportFailure(
 553         CRX_PUBLIC_KEY_INVALID,
 554         l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_ERROR_CODE,
 555                                    ASCIIToUTF16("CRX_PUBLIC_KEY_INVALID")));
 556     return false;
 557   }
 558
 559   std::vector<uint8> signature;
 560   signature.resize(header.signature_size);
 561   len = ReadAndHash(&signature.front(), sizeof(uint8), header.signature_size,
 562                     file.get(), hash);
 563   if (len < header.signature_size) {
 564     // Invalid signature
 565     ReportFailure(
 566         CRX_SIGNATURE_INVALID,
 567         l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_ERROR_CODE,
 568                                    ASCIIToUTF16("CRX_SIGNATURE_INVALID")));
 569     return false;
 570   }
 571
 572   crypto::SignatureVerifier verifier;
 573   if (!verifier.VerifyInit(
 574           crx_file::kSignatureAlgorithm, sizeof(crx_file::kSignatureAlgorithm),
 575           &signature.front(), signature.size(), &key.front(), key.size())) {
 576     // Signature verification initialization failed. This is most likely
 577     // caused by a public key in the wrong format (should encode algorithm).
 578     ReportFailure(
 579         CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED,
 580         l10n_util::GetStringFUTF16(
 581             IDS_EXTENSION_PACKAGE_ERROR_CODE,
 582             ASCIIToUTF16("CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED")));
 583     return false;
 584   }
 585
 586   unsigned char buf[1 << 12];
 587   while ((len = ReadAndHash(buf, 1, sizeof(buf), file.get(), hash)) > 0)
 588     verifier.VerifyUpdate(buf, len);
 589
 590   if (!verifier.VerifyFinal()) {
 591     // Signature verification failed
 592     ReportFailure(CRX_SIGNATURE_VERIFICATION_FAILED,
 593                   l10n_util::GetStringFUTF16(
 594                       IDS_EXTENSION_PACKAGE_ERROR_CODE,
 595                       ASCIIToUTF16("CRX_SIGNATURE_VERIFICATION_FAILED")));
 596     return false;
 597   }
 598
 599   std::string public_key =
 600       std::string(reinterpret_cast<char*>(&key.front()), key.size());
 601   base::Base64Encode(public_key, &public_key_);
 602
 603   extension_id_ = crx_file::id_util::GenerateId(public_key);
 604
 605   return FinalizeHash(hash);
 606 }
 607
 608 void SandboxedUnpacker::ReportFailure(FailureReason reason,
 609                                       const base::string16& error) {
 610   UMA_HISTOGRAM_ENUMERATION("Extensions.SandboxUnpackFailureReason", reason,
 611                             NUM_FAILURE_REASONS);
 612   UMA_HISTOGRAM_TIMES("Extensions.SandboxUnpackFailureTime",
 613                       base::TimeTicks::Now() - unpack_start_time_);
 614   Cleanup();
 615
 616   CrxInstallError error_info(reason == CRX_HASH_VERIFICATION_FAILED
 617                                  ? CrxInstallError::ERROR_HASH_MISMATCH
 618                                  : CrxInstallError::ERROR_OTHER,
 619                              error);
 620
 621   client_->OnUnpackFailure(error_info);
 622 }
 623
 624 void SandboxedUnpacker::ReportSuccess(
 625     const base::DictionaryValue& original_manifest,
 626     const SkBitmap& install_icon) {
 627   UMA_HISTOGRAM_COUNTS("Extensions.SandboxUnpackSuccess", 1);
 628
 629   RecordSuccessfulUnpackTimeHistograms(
 630       crx_path_, base::TimeTicks::Now() - unpack_start_time_);
 631
 632   // Client takes ownership of temporary directory and extension.
 633   client_->OnUnpackSuccess(temp_dir_.Take(), extension_root_,
 634                            &original_manifest, extension_.get(), install_icon);
 635   extension_ = NULL;
 636 }
 637
 638 base::DictionaryValue* SandboxedUnpacker::RewriteManifestFile(
 639     const base::DictionaryValue& manifest) {
 640   // Add the public key extracted earlier to the parsed manifest and overwrite
 641   // the original manifest. We do this to ensure the manifest doesn't contain an
 642   // exploitable bug that could be used to compromise the browser.
 643   scoped_ptr<base::DictionaryValue> final_manifest(manifest.DeepCopy());
 644   final_manifest->SetString(manifest_keys::kPublicKey, public_key_);
 645
 646   std::string manifest_json;
 647   JSONStringValueSerializer serializer(&manifest_json);
 648   serializer.set_pretty_print(true);
 649   if (!serializer.Serialize(*final_manifest)) {
 650     // Error serializing manifest.json.
 651     ReportFailure(ERROR_SERIALIZING_MANIFEST_JSON,
 652                   l10n_util::GetStringFUTF16(
 653                       IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 654                       ASCIIToUTF16("ERROR_SERIALIZING_MANIFEST_JSON")));
 655     return NULL;
 656   }
 657
 658   base::FilePath manifest_path = extension_root_.Append(kManifestFilename);
 659   int size = base::checked_cast<int>(manifest_json.size());
 660   if (base::WriteFile(manifest_path, manifest_json.data(), size) != size) {
 661     // Error saving manifest.json.
 662     ReportFailure(
 663         ERROR_SAVING_MANIFEST_JSON,
 664         l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 665                                    ASCIIToUTF16("ERROR_SAVING_MANIFEST_JSON")));
 666     return NULL;
 667   }
 668
 669   return final_manifest.release();
 670 }
 671
 672 bool SandboxedUnpacker::RewriteImageFiles(SkBitmap* install_icon) {
 673   DecodedImages images;
 674   if (!ReadImagesFromFile(temp_dir_.path(), &images)) {
 675     // Couldn't read image data from disk.
 676     ReportFailure(COULD_NOT_READ_IMAGE_DATA_FROM_DISK,
 677                   l10n_util::GetStringFUTF16(
 678                       IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 679                       ASCIIToUTF16("COULD_NOT_READ_IMAGE_DATA_FROM_DISK")));
 680     return false;
 681   }
 682
 683   // Delete any images that may be used by the browser.  We're going to write
 684   // out our own versions of the parsed images, and we want to make sure the
 685   // originals are gone for good.
 686   std::set<base::FilePath> image_paths =
 687       ExtensionsClient::Get()->GetBrowserImagePaths(extension_.get());
 688   if (image_paths.size() != images.size()) {
 689     // Decoded images don't match what's in the manifest.
 690     ReportFailure(
 691         DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST,
 692         l10n_util::GetStringFUTF16(
 693             IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 694             ASCIIToUTF16("DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST")));
 695     return false;
 696   }
 697
 698   for (std::set<base::FilePath>::iterator it = image_paths.begin();
 699        it != image_paths.end(); ++it) {
 700     base::FilePath path = *it;
 701     if (path.IsAbsolute() || path.ReferencesParent()) {
 702       // Invalid path for browser image.
 703       ReportFailure(INVALID_PATH_FOR_BROWSER_IMAGE,
 704                     l10n_util::GetStringFUTF16(
 705                         IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 706                         ASCIIToUTF16("INVALID_PATH_FOR_BROWSER_IMAGE")));
 707       return false;
 708     }
 709     if (!base::DeleteFile(extension_root_.Append(path), false)) {
 710       // Error removing old image file.
 711       ReportFailure(ERROR_REMOVING_OLD_IMAGE_FILE,
 712                     l10n_util::GetStringFUTF16(
 713                         IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 714                         ASCIIToUTF16("ERROR_REMOVING_OLD_IMAGE_FILE")));
 715       return false;
 716     }
 717   }
 718
 719   const std::string& install_icon_path =
 720       IconsInfo::GetIcons(extension_.get())
 721           .Get(extension_misc::EXTENSION_ICON_LARGE,
 722                ExtensionIconSet::MATCH_BIGGER);
 723
 724   // Write our parsed images back to disk as well.
 725   for (size_t i = 0; i < images.size(); ++i) {
 726     if (BrowserThread::GetBlockingPool()->IsShutdownInProgress()) {
 727       // Abort package installation if shutdown was initiated, crbug.com/235525
 728       ReportFailure(
 729           ABORTED_DUE_TO_SHUTDOWN,
 730           l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 731                                      ASCIIToUTF16("ABORTED_DUE_TO_SHUTDOWN")));
 732       return false;
 733     }
 734
 735     const SkBitmap& image = get<0>(images[i]);
 736     base::FilePath path_suffix = get<1>(images[i]);
 737     if (path_suffix.MaybeAsASCII() == install_icon_path)
 738       *install_icon = image;
 739
 740     if (path_suffix.IsAbsolute() || path_suffix.ReferencesParent()) {
 741       // Invalid path for bitmap image.
 742       ReportFailure(INVALID_PATH_FOR_BITMAP_IMAGE,
 743                     l10n_util::GetStringFUTF16(
 744                         IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 745                         ASCIIToUTF16("INVALID_PATH_FOR_BITMAP_IMAGE")));
 746       return false;
 747     }
 748     base::FilePath path = extension_root_.Append(path_suffix);
 749
 750     std::vector<unsigned char> image_data;
 751     // TODO(mpcomplete): It's lame that we're encoding all images as PNG, even
 752     // though they may originally be .jpg, etc.  Figure something out.
 753     // http://code.google.com/p/chromium/issues/detail?id=12459
 754     if (!gfx::PNGCodec::EncodeBGRASkBitmap(image, false, &image_data)) {
 755       // Error re-encoding theme image.
 756       ReportFailure(ERROR_RE_ENCODING_THEME_IMAGE,
 757                     l10n_util::GetStringFUTF16(
 758                         IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 759                         ASCIIToUTF16("ERROR_RE_ENCODING_THEME_IMAGE")));
 760       return false;
 761     }
 762
 763     // Note: we're overwriting existing files that the utility process wrote,
 764     // so we can be sure the directory exists.
 765     const char* image_data_ptr = reinterpret_cast<const char*>(&image_data[0]);
 766     int size = base::checked_cast<int>(image_data.size());
 767     if (base::WriteFile(path, image_data_ptr, size) != size) {
 768       // Error saving theme image.
 769       ReportFailure(
 770           ERROR_SAVING_THEME_IMAGE,
 771           l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 772                                      ASCIIToUTF16("ERROR_SAVING_THEME_IMAGE")));
 773       return false;
 774     }
 775   }
 776
 777   return true;
 778 }
 779
 780 bool SandboxedUnpacker::RewriteCatalogFiles() {
 781   base::DictionaryValue catalogs;
 782   if (!ReadMessageCatalogsFromFile(temp_dir_.path(), &catalogs)) {
 783     // Could not read catalog data from disk.
 784     ReportFailure(COULD_NOT_READ_CATALOG_DATA_FROM_DISK,
 785                   l10n_util::GetStringFUTF16(
 786                       IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 787                       ASCIIToUTF16("COULD_NOT_READ_CATALOG_DATA_FROM_DISK")));
 788     return false;
 789   }
 790
 791   // Write our parsed catalogs back to disk.
 792   for (base::DictionaryValue::Iterator it(catalogs); !it.IsAtEnd();
 793        it.Advance()) {
 794     const base::DictionaryValue* catalog = NULL;
 795     if (!it.value().GetAsDictionary(&catalog)) {
 796       // Invalid catalog data.
 797       ReportFailure(
 798           INVALID_CATALOG_DATA,
 799           l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 800                                      ASCIIToUTF16("INVALID_CATALOG_DATA")));
 801       return false;
 802     }
 803
 804     base::FilePath relative_path = base::FilePath::FromUTF8Unsafe(it.key());
 805     relative_path = relative_path.Append(kMessagesFilename);
 806     if (relative_path.IsAbsolute() || relative_path.ReferencesParent()) {
 807       // Invalid path for catalog.
 808       ReportFailure(
 809           INVALID_PATH_FOR_CATALOG,
 810           l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 811                                      ASCIIToUTF16("INVALID_PATH_FOR_CATALOG")));
 812       return false;
 813     }
 814     base::FilePath path = extension_root_.Append(relative_path);
 815
 816     std::string catalog_json;
 817     JSONStringValueSerializer serializer(&catalog_json);
 818     serializer.set_pretty_print(true);
 819     if (!serializer.Serialize(*catalog)) {
 820       // Error serializing catalog.
 821       ReportFailure(ERROR_SERIALIZING_CATALOG,
 822                     l10n_util::GetStringFUTF16(
 823                         IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 824                         ASCIIToUTF16("ERROR_SERIALIZING_CATALOG")));
 825       return false;
 826     }
 827
 828     // Note: we're overwriting existing files that the utility process read,
 829     // so we can be sure the directory exists.
 830     int size = base::checked_cast<int>(catalog_json.size());
 831     if (base::WriteFile(path, catalog_json.c_str(), size) != size) {
 832       // Error saving catalog.
 833       ReportFailure(
 834           ERROR_SAVING_CATALOG,
 835           l10n_util::GetStringFUTF16(IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 836                                      ASCIIToUTF16("ERROR_SAVING_CATALOG")));
 837       return false;
 838     }
 839   }
 840
 841   return true;
 842 }
 843
 844 void SandboxedUnpacker::Cleanup() {
 845   DCHECK(unpacker_io_task_runner_->RunsTasksOnCurrentThread());
 846   if (!temp_dir_.Delete()) {
 847     LOG(WARNING) << "Can not delete temp directory at "
 848                  << temp_dir_.path().value();
 849   }
 850 }
 851
 852 }  // namespace extensions