extensions/browser/sandboxed_unpacker.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
   6 #define CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
   7
   8 #include <string>
   9
  10 #include "base/files/file_path.h"
  11 #include "base/files/scoped_temp_dir.h"
  12 #include "base/memory/ref_counted_delete_on_message_loop.h"
  13 #include "base/time/time.h"
  14 #include "content/public/browser/browser_thread.h"
  15 #include "content/public/browser/utility_process_host_client.h"
  16 #include "extensions/browser/crx_file_info.h"
  17 #include "extensions/browser/install/crx_install_error.h"
  18 #include "extensions/common/manifest.h"
  19
  20 class SkBitmap;
  21
  22 namespace base {
  23 class DictionaryValue;
  24 class SequencedTaskRunner;
  25 }
  26
  27 namespace crypto {
  28 class SecureHash;
  29 }
  30
  31 namespace extensions {
  32 class Extension;
  33
  34 class SandboxedUnpackerClient
  35     : public base::RefCountedDeleteOnMessageLoop<SandboxedUnpackerClient> {
  36  public:
  37   // Initialize the ref-counted base to always delete on the UI thread. Note
  38   // the constructor call must also happen on the UI thread.
  39   SandboxedUnpackerClient();
  40
  41   // temp_dir - A temporary directory containing the results of the extension
  42   // unpacking. The client is responsible for deleting this directory.
  43   //
  44   // extension_root - The path to the extension root inside of temp_dir.
  45   //
  46   // original_manifest - The parsed but unmodified version of the manifest,
  47   // with no modifications such as localization, etc.
  48   //
  49   // extension - The extension that was unpacked. The client is responsible
  50   // for deleting this memory.
  51   //
  52   // install_icon - The icon we will display in the installation UI, if any.
  53   virtual void OnUnpackSuccess(const base::FilePath& temp_dir,
  54                                const base::FilePath& extension_root,
  55                                const base::DictionaryValue* original_manifest,
  56                                const Extension* extension,
  57                                const SkBitmap& install_icon) = 0;
  58   virtual void OnUnpackFailure(const CrxInstallError& error) = 0;
  59
  60  protected:
  61   friend class base::RefCountedDeleteOnMessageLoop<SandboxedUnpackerClient>;
  62   friend class base::DeleteHelper<SandboxedUnpackerClient>;
  63
  64   virtual ~SandboxedUnpackerClient() {}
  65 };
  66
  67 // SandboxedUnpacker unpacks extensions from the CRX format into a
  68 // directory. This is done in a sandboxed subprocess to protect the browser
  69 // process from parsing complex formats like JPEG or JSON from untrusted
  70 // sources.
  71 //
  72 // Unpacking an extension using this class makes minor changes to its source,
  73 // such as transcoding all images to PNG, parsing all message catalogs
  74 // and rewriting the manifest JSON. As such, it should not be used when the
  75 // output is not intended to be given back to the author.
  76 //
  77 //
  78 // Lifetime management:
  79 //
  80 // This class is ref-counted by each call it makes to itself on another thread,
  81 // and by UtilityProcessHost.
  82 //
  83 // Additionally, we hold a reference to our own client so that it lives at least
  84 // long enough to receive the result of unpacking.
  85 //
  86 //
  87 // NOTE: This class should only be used on the file thread.
  88 class SandboxedUnpacker : public content::UtilityProcessHostClient {
  89  public:
  90   // Unpacks the extension in |crx_path| into a temporary directory and calls
  91   // |client| with the result. If |run_out_of_process| is provided, unpacking
  92   // is done in a sandboxed subprocess. Otherwise, it is done in-process.
  93   SandboxedUnpacker(
  94       const CRXFileInfo& file,
  95       Manifest::Location location,
  96       int creation_flags,
  97       const base::FilePath& extensions_dir,
  98       const scoped_refptr<base::SequencedTaskRunner>& unpacker_io_task_runner,
  99       SandboxedUnpackerClient* client);
 100
 101   // Start unpacking the extension. The client is called with the results.
 102   void Start();
 103
 104  private:
 105   class ProcessHostClient;
 106
 107   // Enumerate all the ways unpacking can fail.  Calls to ReportFailure()
 108   // take a failure reason as an argument, and put it in histogram
 109   // Extensions.SandboxUnpackFailureReason.
 110   enum FailureReason {
 111     // SandboxedUnpacker::CreateTempDirectory()
 112     COULD_NOT_GET_TEMP_DIRECTORY,
 113     COULD_NOT_CREATE_TEMP_DIRECTORY,
 114
 115     // SandboxedUnpacker::Start()
 116     FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY,
 117     COULD_NOT_GET_SANDBOX_FRIENDLY_PATH,
 118
 119     // SandboxedUnpacker::OnUnpackExtensionSucceeded()
 120     COULD_NOT_LOCALIZE_EXTENSION,
 121     INVALID_MANIFEST,
 122
 123     // SandboxedUnpacker::OnUnpackExtensionFailed()
 124     UNPACKER_CLIENT_FAILED,
 125
 126     // SandboxedUnpacker::OnProcessCrashed()
 127     UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL,
 128
 129     // SandboxedUnpacker::ValidateSignature()
 130     CRX_FILE_NOT_READABLE,
 131     CRX_HEADER_INVALID,
 132     CRX_MAGIC_NUMBER_INVALID,
 133     CRX_VERSION_NUMBER_INVALID,
 134     CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE,
 135     CRX_ZERO_KEY_LENGTH,
 136     CRX_ZERO_SIGNATURE_LENGTH,
 137     CRX_PUBLIC_KEY_INVALID,
 138     CRX_SIGNATURE_INVALID,
 139     CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED,
 140     CRX_SIGNATURE_VERIFICATION_FAILED,
 141
 142     // SandboxedUnpacker::RewriteManifestFile()
 143     ERROR_SERIALIZING_MANIFEST_JSON,
 144     ERROR_SAVING_MANIFEST_JSON,
 145
 146     // SandboxedUnpacker::RewriteImageFiles()
 147     COULD_NOT_READ_IMAGE_DATA_FROM_DISK,
 148     DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST,
 149     INVALID_PATH_FOR_BROWSER_IMAGE,
 150     ERROR_REMOVING_OLD_IMAGE_FILE,
 151     INVALID_PATH_FOR_BITMAP_IMAGE,
 152     ERROR_RE_ENCODING_THEME_IMAGE,
 153     ERROR_SAVING_THEME_IMAGE,
 154     ABORTED_DUE_TO_SHUTDOWN,
 155
 156     // SandboxedUnpacker::RewriteCatalogFiles()
 157     COULD_NOT_READ_CATALOG_DATA_FROM_DISK,
 158     INVALID_CATALOG_DATA,
 159     INVALID_PATH_FOR_CATALOG,
 160     ERROR_SERIALIZING_CATALOG,
 161     ERROR_SAVING_CATALOG,
 162
 163     // SandboxedUnpacker::ValidateSignature()
 164     CRX_HASH_VERIFICATION_FAILED,
 165
 166     NUM_FAILURE_REASONS
 167   };
 168
 169   friend class ProcessHostClient;
 170   friend class SandboxedUnpackerTest;
 171
 172   ~SandboxedUnpacker() override;
 173
 174   // Set |temp_dir_| as a temporary directory to unpack the extension in.
 175   // Return true on success.
 176   virtual bool CreateTempDirectory();
 177
 178   // Helper functions to simplify calls to ReportFailure.
 179   base::string16 FailureReasonToString16(FailureReason reason);
 180   void FailWithPackageError(FailureReason reason);
 181
 182   // Validates the signature of the extension and extract the key to
 183   // |public_key_|. Returns true if the signature validates, false otherwise.
 184   bool ValidateSignature();
 185
 186   // Starts the utility process that unpacks our extension.
 187   void StartProcessOnIOThread(const base::FilePath& temp_crx_path);
 188
 189   // UtilityProcessHostClient
 190   bool OnMessageReceived(const IPC::Message& message) override;
 191   void OnProcessCrashed(int exit_code) override;
 192
 193   // IPC message handlers.
 194   void OnUnpackExtensionSucceeded(const base::DictionaryValue& manifest);
 195   void OnUnpackExtensionFailed(const base::string16& error_message);
 196
 197   void ReportFailure(FailureReason reason, const base::string16& message);
 198   void ReportSuccess(const base::DictionaryValue& original_manifest,
 199                      const SkBitmap& install_icon);
 200
 201   // Overwrites original manifest with safe result from utility process.
 202   // Returns NULL on error. Caller owns the returned object.
 203   base::DictionaryValue* RewriteManifestFile(
 204       const base::DictionaryValue& manifest);
 205
 206   // Overwrites original files with safe results from utility process.
 207   // Reports error and returns false if it fails.
 208   bool RewriteImageFiles(SkBitmap* install_icon);
 209   bool RewriteCatalogFiles();
 210
 211   // Cleans up temp directory artifacts.
 212   void Cleanup();
 213
 214   // The path to the CRX to unpack.
 215   base::FilePath crx_path_;
 216
 217   // The package SHA256 hash sum that was reported from the Web Store.
 218   std::string package_hash_;
 219
 220   // Whether we need to check the .crx hash sum.
 221   bool check_crx_hash_;
 222
 223   // Our client.
 224   scoped_refptr<SandboxedUnpackerClient> client_;
 225
 226   // The Extensions directory inside the profile.
 227   base::FilePath extensions_dir_;
 228
 229   // A temporary directory to use for unpacking.
 230   base::ScopedTempDir temp_dir_;
 231
 232   // The root directory of the unpacked extension. This is a child of temp_dir_.
 233   base::FilePath extension_root_;
 234
 235   // Represents the extension we're unpacking.
 236   scoped_refptr<Extension> extension_;
 237
 238   // Whether we've received a response from the utility process yet.
 239   bool got_response_;
 240
 241   // The public key that was extracted from the CRX header.
 242   std::string public_key_;
 243
 244   // The extension's ID. This will be calculated from the public key in the crx
 245   // header.
 246   std::string extension_id_;
 247
 248   // Time at which unpacking started. Used to compute the time unpacking takes.
 249   base::TimeTicks unpack_start_time_;
 250
 251   // Location to use for the unpacked extension.
 252   Manifest::Location location_;
 253
 254   // Creation flags to use for the extension.  These flags will be used
 255   // when calling Extenion::Create() by the crx installer.
 256   int creation_flags_;
 257
 258   // Sequenced task runner where file I/O operations will be performed at.
 259   scoped_refptr<base::SequencedTaskRunner> unpacker_io_task_runner_;
 260 };
 261
 262 }  // namespace extensions
 263
 264 #endif  // CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_