net/base/filename_util_internal.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/base/filename_util.h"
   6
   7 #include "base/files/file_path.h"
   8 #include "base/files/file_util.h"
   9 #include "base/strings/string_util.h"
  10 #include "base/strings/sys_string_conversions.h"
  11 #include "base/strings/utf_string_conversions.h"
  12 #include "base/threading/thread_restrictions.h"
  13 #include "net/base/escape.h"
  14 #include "net/base/filename_util_internal.h"
  15 #include "net/base/mime_util.h"
  16 #include "net/base/net_string_util.h"
  17 #include "net/http/http_content_disposition.h"
  18 #include "url/gurl.h"
  19
  20 namespace net {
  21
  22 void SanitizeGeneratedFileName(base::FilePath::StringType* filename,
  23                                bool replace_trailing) {
  24   const base::FilePath::CharType kReplace[] = FILE_PATH_LITERAL("-");
  25   if (filename->empty())
  26     return;
  27   if (replace_trailing) {
  28     // Handle CreateFile() stripping trailing dots and spaces on filenames
  29     // http://support.microsoft.com/kb/115827
  30     size_t length = filename->size();
  31     size_t pos = filename->find_last_not_of(FILE_PATH_LITERAL(" ."));
  32     filename->resize((pos == std::string::npos) ? 0 : (pos + 1));
  33     base::TrimWhitespace(*filename, base::TRIM_TRAILING, filename);
  34     if (filename->empty())
  35       return;
  36     size_t trimmed = length - filename->size();
  37     if (trimmed)
  38       filename->insert(filename->end(), trimmed, kReplace[0]);
  39   }
  40   base::TrimString(*filename, FILE_PATH_LITERAL("."), filename);
  41   if (filename->empty())
  42     return;
  43   // Replace any path information by changing path separators.
  44   ReplaceSubstringsAfterOffset(filename, 0, FILE_PATH_LITERAL("/"), kReplace);
  45   ReplaceSubstringsAfterOffset(filename, 0, FILE_PATH_LITERAL("\\"), kReplace);
  46 }
  47
  48 // Returns the filename determined from the last component of the path portion
  49 // of the URL.  Returns an empty string if the URL doesn't have a path or is
  50 // invalid. If the generated filename is not reliable,
  51 // |should_overwrite_extension| will be set to true, in which case a better
  52 // extension should be determined based on the content type.
  53 std::string GetFileNameFromURL(const GURL& url,
  54                                const std::string& referrer_charset,
  55                                bool* should_overwrite_extension) {
  56   // about: and data: URLs don't have file names, but esp. data: URLs may
  57   // contain parts that look like ones (i.e., contain a slash).  Therefore we
  58   // don't attempt to divine a file name out of them.
  59   if (!url.is_valid() || url.SchemeIs("about") || url.SchemeIs("data"))
  60     return std::string();
  61
  62   const std::string unescaped_url_filename = UnescapeURLComponent(
  63       url.ExtractFileName(),
  64       UnescapeRule::SPACES | UnescapeRule::URL_SPECIAL_CHARS);
  65
  66   // The URL's path should be escaped UTF-8, but may not be.
  67   std::string decoded_filename = unescaped_url_filename;
  68   if (!base::IsStringUTF8(decoded_filename)) {
  69     // TODO(jshin): this is probably not robust enough. To be sure, we need
  70     // encoding detection.
  71     base::string16 utf16_output;
  72     if (!referrer_charset.empty() &&
  73         ConvertToUTF16(unescaped_url_filename, referrer_charset.c_str(),
  74                        &utf16_output)) {
  75       decoded_filename = base::UTF16ToUTF8(utf16_output);
  76     } else {
  77       decoded_filename =
  78           base::WideToUTF8(base::SysNativeMBToWide(unescaped_url_filename));
  79     }
  80   }
  81   // If the URL contains a (possibly empty) query, assume it is a generator, and
  82   // allow the determined extension to be overwritten.
  83   *should_overwrite_extension = !decoded_filename.empty() && url.has_query();
  84
  85   return decoded_filename;
  86 }
  87
  88 // Returns whether the specified extension is automatically integrated into the
  89 // windows shell.
  90 bool IsShellIntegratedExtension(const base::FilePath::StringType& extension) {
  91   base::FilePath::StringType extension_lower =
  92       base::StringToLowerASCII(extension);
  93
  94   // http://msdn.microsoft.com/en-us/library/ms811694.aspx
  95   // Right-clicking on shortcuts can be magical.
  96   if ((extension_lower == FILE_PATH_LITERAL("local")) ||
  97       (extension_lower == FILE_PATH_LITERAL("lnk")))
  98     return true;
  99
 100   // http://www.juniper.net/security/auto/vulnerabilities/vuln2612.html
 101   // Files become magical if they end in a CLSID, so block such extensions.
 102   if (!extension_lower.empty() &&
 103       (extension_lower[0] == FILE_PATH_LITERAL('{')) &&
 104       (extension_lower[extension_lower.length() - 1] == FILE_PATH_LITERAL('}')))
 105     return true;
 106   return false;
 107 }
 108
 109 // Returns whether the specified file name is a reserved name on windows.
 110 // This includes names like "com2.zip" (which correspond to devices) and
 111 // desktop.ini and thumbs.db which have special meaning to the windows shell.
 112 bool IsReservedName(const base::FilePath::StringType& filename) {
 113   // This list is taken from the MSDN article "Naming a file"
 114   // http://msdn2.microsoft.com/en-us/library/aa365247(VS.85).aspx
 115   // I also added clock$ because GetSaveFileName seems to consider it as a
 116   // reserved name too.
 117   static const char* const known_devices[] = {
 118       "con",  "prn",  "aux",  "nul",  "com1", "com2", "com3",  "com4",
 119       "com5", "com6", "com7", "com8", "com9", "lpt1", "lpt2",  "lpt3",
 120       "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9", "clock$"};
 121 #if defined(OS_WIN)
 122   std::string filename_lower =
 123       base::StringToLowerASCII(base::WideToUTF8(filename));
 124 #elif defined(OS_POSIX)
 125   std::string filename_lower = base::StringToLowerASCII(filename);
 126 #endif
 127
 128   for (size_t i = 0; i < arraysize(known_devices); ++i) {
 129     // Exact match.
 130     if (filename_lower == known_devices[i])
 131       return true;
 132     // Starts with "DEVICE.".
 133     if (filename_lower.find(std::string(known_devices[i]) + ".") == 0)
 134       return true;
 135   }
 136
 137   static const char* const magic_names[] = {
 138     // These file names are used by the "Customize folder" feature of the shell.
 139     "desktop.ini",
 140     "thumbs.db",
 141   };
 142
 143   for (size_t i = 0; i < arraysize(magic_names); ++i) {
 144     if (filename_lower == magic_names[i])
 145       return true;
 146   }
 147
 148   return false;
 149 }
 150
 151 // Examines the current extension in |file_name| and modifies it if necessary in
 152 // order to ensure the filename is safe.  If |file_name| doesn't contain an
 153 // extension or if |ignore_extension| is true, then a new extension will be
 154 // constructed based on the |mime_type|.
 155 //
 156 // We're addressing two things here:
 157 //
 158 // 1) Usability.  If there is no reliable file extension, we want to guess a
 159 //    reasonable file extension based on the content type.
 160 //
 161 // 2) Shell integration.  Some file extensions automatically integrate with the
 162 //    shell.  We block these extensions to prevent a malicious web site from
 163 //    integrating with the user's shell.
 164 void EnsureSafeExtension(const std::string& mime_type,
 165                          bool ignore_extension,
 166                          base::FilePath* file_name) {
 167   // See if our file name already contains an extension.
 168   base::FilePath::StringType extension = file_name->Extension();
 169   if (!extension.empty())
 170     extension.erase(extension.begin());  // Erase preceding '.'.
 171
 172   if ((ignore_extension || extension.empty()) && !mime_type.empty()) {
 173     base::FilePath::StringType preferred_mime_extension;
 174     std::vector<base::FilePath::StringType> all_mime_extensions;
 175     GetPreferredExtensionForMimeType(mime_type, &preferred_mime_extension);
 176     GetExtensionsForMimeType(mime_type, &all_mime_extensions);
 177     // If the existing extension is in the list of valid extensions for the
 178     // given type, use it. This avoids doing things like pointlessly renaming
 179     // "foo.jpg" to "foo.jpeg".
 180     if (std::find(all_mime_extensions.begin(),
 181                   all_mime_extensions.end(),
 182                   extension) != all_mime_extensions.end()) {
 183       // leave |extension| alone
 184     } else if (!preferred_mime_extension.empty()) {
 185       extension = preferred_mime_extension;
 186     }
 187   }
 188
 189 #if defined(OS_WIN)
 190   static const base::FilePath::CharType default_extension[] =
 191       FILE_PATH_LITERAL("download");
 192
 193   // Rename shell-integrated extensions.
 194   // TODO(asanka): Consider stripping out the bad extension and replacing it
 195   // with the preferred extension for the MIME type if one is available.
 196   if (IsShellIntegratedExtension(extension))
 197     extension.assign(default_extension);
 198 #endif
 199
 200   *file_name = file_name->ReplaceExtension(extension);
 201 }
 202
 203 bool FilePathToString16(const base::FilePath& path, base::string16* converted) {
 204 #if defined(OS_WIN)
 205   *converted = path.value();
 206   return true;
 207 #elif defined(OS_POSIX)
 208   std::string component8 = path.AsUTF8Unsafe();
 209   return !component8.empty() &&
 210          base::UTF8ToUTF16(component8.c_str(), component8.size(), converted);
 211 #endif
 212 }
 213
 214 base::string16 GetSuggestedFilenameImpl(
 215     const GURL& url,
 216     const std::string& content_disposition,
 217     const std::string& referrer_charset,
 218     const std::string& suggested_name,
 219     const std::string& mime_type,
 220     const std::string& default_name,
 221     ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
 222   // TODO: this function to be updated to match the httpbis recommendations.
 223   // Talk to abarth for the latest news.
 224
 225   // We don't translate this fallback string, "download". If localization is
 226   // needed, the caller should provide localized fallback in |default_name|.
 227   static const base::FilePath::CharType kFinalFallbackName[] =
 228       FILE_PATH_LITERAL("download");
 229   std::string filename;  // In UTF-8
 230   bool overwrite_extension = false;
 231   bool is_name_from_content_disposition = false;
 232   // Try to extract a filename from content-disposition first.
 233   if (!content_disposition.empty()) {
 234     HttpContentDisposition header(content_disposition, referrer_charset);
 235     filename = header.filename();
 236     if (!filename.empty())
 237       is_name_from_content_disposition = true;
 238   }
 239
 240   // Then try to use the suggested name.
 241   if (filename.empty() && !suggested_name.empty())
 242     filename = suggested_name;
 243
 244   // Now try extracting the filename from the URL.  GetFileNameFromURL() only
 245   // looks at the last component of the URL and doesn't return the hostname as a
 246   // failover.
 247   if (filename.empty())
 248     filename = GetFileNameFromURL(url, referrer_charset, &overwrite_extension);
 249
 250   // Finally try the URL hostname, but only if there's no default specified in
 251   // |default_name|.  Some schemes (e.g.: file:, about:, data:) do not have a
 252   // host name.
 253   if (filename.empty() && default_name.empty() && url.is_valid() &&
 254       !url.host().empty()) {
 255     // TODO(jungshik) : Decode a 'punycoded' IDN hostname. (bug 1264451)
 256     filename = url.host();
 257   }
 258
 259   bool replace_trailing = false;
 260   base::FilePath::StringType result_str, default_name_str;
 261 #if defined(OS_WIN)
 262   replace_trailing = true;
 263   result_str = base::UTF8ToUTF16(filename);
 264   default_name_str = base::UTF8ToUTF16(default_name);
 265 #else
 266   result_str = filename;
 267   default_name_str = default_name;
 268 #endif
 269   SanitizeGeneratedFileName(&result_str, replace_trailing);
 270   if (result_str.find_last_not_of(FILE_PATH_LITERAL("-_")) ==
 271       base::FilePath::StringType::npos) {
 272     result_str = !default_name_str.empty()
 273                      ? default_name_str
 274                      : base::FilePath::StringType(kFinalFallbackName);
 275     overwrite_extension = false;
 276   }
 277   replace_illegal_characters_callback.Run(&result_str, '-');
 278   base::FilePath result(result_str);
 279   // extension should not appended to filename derived from
 280   // content-disposition, if it does not have one.
 281   // Hence mimetype and overwrite_extension values are not used.
 282   if (is_name_from_content_disposition)
 283     GenerateSafeFileName("", false, &result);
 284   else
 285     GenerateSafeFileName(mime_type, overwrite_extension, &result);
 286
 287   base::string16 result16;
 288   if (!FilePathToString16(result, &result16)) {
 289     result = base::FilePath(default_name_str);
 290     if (!FilePathToString16(result, &result16)) {
 291       result = base::FilePath(kFinalFallbackName);
 292       FilePathToString16(result, &result16);
 293     }
 294   }
 295   return result16;
 296 }
 297
 298 base::FilePath GenerateFileNameImpl(
 299     const GURL& url,
 300     const std::string& content_disposition,
 301     const std::string& referrer_charset,
 302     const std::string& suggested_name,
 303     const std::string& mime_type,
 304     const std::string& default_file_name,
 305     ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
 306   base::string16 file_name =
 307       GetSuggestedFilenameImpl(url,
 308                                content_disposition,
 309                                referrer_charset,
 310                                suggested_name,
 311                                mime_type,
 312                                default_file_name,
 313                                replace_illegal_characters_callback);
 314
 315 #if defined(OS_WIN)
 316   base::FilePath generated_name(file_name);
 317 #else
 318   base::FilePath generated_name(
 319       base::SysWideToNativeMB(base::UTF16ToWide(file_name)));
 320 #endif
 321
 322   DCHECK(!generated_name.empty());
 323
 324   return generated_name;
 325 }
 326
 327 }  // namespace net