net/base/filename_util_internal.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/base/filename_util.h"
   6
   7 #include "base/files/file_path.h"
   8 #include "base/files/file_util.h"
   9 #include "base/strings/string_util.h"
  10 #include "base/strings/sys_string_conversions.h"
  11 #include "base/strings/utf_string_conversions.h"
  12 #include "base/threading/thread_restrictions.h"
  13 #include "net/base/escape.h"
  14 #include "net/base/filename_util_internal.h"
  15 #include "net/base/mime_util.h"
  16 #include "net/base/net_string_util.h"
  17 #include "net/http/http_content_disposition.h"
  18 #include "url/gurl.h"
  19
  20 namespace net {
  21
  22 void SanitizeGeneratedFileName(base::FilePath::StringType* filename,
  23                                bool replace_trailing) {
  24   const base::FilePath::CharType kReplace[] = FILE_PATH_LITERAL("-");
  25   if (filename->empty())
  26     return;
  27   if (replace_trailing) {
  28     // Handle CreateFile() stripping trailing dots and spaces on filenames
  29     // http://support.microsoft.com/kb/115827
  30     size_t length = filename->size();
  31     size_t pos = filename->find_last_not_of(FILE_PATH_LITERAL(" ."));
  32     filename->resize((pos == std::string::npos) ? 0 : (pos + 1));
  33     base::TrimWhitespace(*filename, base::TRIM_TRAILING, filename);
  34     if (filename->empty())
  35       return;
  36     size_t trimmed = length - filename->size();
  37     if (trimmed)
  38       filename->insert(filename->end(), trimmed, kReplace[0]);
  39   }
  40   base::TrimString(*filename, FILE_PATH_LITERAL("."), filename);
  41   if (filename->empty())
  42     return;
  43   // Replace any path information by changing path separators.
  44   base::ReplaceSubstringsAfterOffset(
  45       filename, 0, FILE_PATH_LITERAL("/"), kReplace);
  46   base::ReplaceSubstringsAfterOffset(
  47       filename, 0, FILE_PATH_LITERAL("\\"), kReplace);
  48 }
  49
  50 // Returns the filename determined from the last component of the path portion
  51 // of the URL.  Returns an empty string if the URL doesn't have a path or is
  52 // invalid. If the generated filename is not reliable,
  53 // |should_overwrite_extension| will be set to true, in which case a better
  54 // extension should be determined based on the content type.
  55 std::string GetFileNameFromURL(const GURL& url,
  56                                const std::string& referrer_charset,
  57                                bool* should_overwrite_extension) {
  58   // about: and data: URLs don't have file names, but esp. data: URLs may
  59   // contain parts that look like ones (i.e., contain a slash).  Therefore we
  60   // don't attempt to divine a file name out of them.
  61   if (!url.is_valid() || url.SchemeIs("about") || url.SchemeIs("data"))
  62     return std::string();
  63
  64   const std::string unescaped_url_filename = UnescapeURLComponent(
  65       url.ExtractFileName(),
  66       UnescapeRule::SPACES | UnescapeRule::URL_SPECIAL_CHARS);
  67
  68   // The URL's path should be escaped UTF-8, but may not be.
  69   std::string decoded_filename = unescaped_url_filename;
  70   if (!base::IsStringUTF8(decoded_filename)) {
  71     // TODO(jshin): this is probably not robust enough. To be sure, we need
  72     // encoding detection.
  73     base::string16 utf16_output;
  74     if (!referrer_charset.empty() &&
  75         ConvertToUTF16(unescaped_url_filename, referrer_charset.c_str(),
  76                        &utf16_output)) {
  77       decoded_filename = base::UTF16ToUTF8(utf16_output);
  78     } else {
  79       decoded_filename =
  80           base::WideToUTF8(base::SysNativeMBToWide(unescaped_url_filename));
  81     }
  82   }
  83   // If the URL contains a (possibly empty) query, assume it is a generator, and
  84   // allow the determined extension to be overwritten.
  85   *should_overwrite_extension = !decoded_filename.empty() && url.has_query();
  86
  87   return decoded_filename;
  88 }
  89
  90 // Returns whether the specified extension is automatically integrated into the
  91 // windows shell.
  92 bool IsShellIntegratedExtension(const base::FilePath::StringType& extension) {
  93   base::FilePath::StringType extension_lower = base::ToLowerASCII(extension);
  94
  95   // http://msdn.microsoft.com/en-us/library/ms811694.aspx
  96   // Right-clicking on shortcuts can be magical.
  97   if ((extension_lower == FILE_PATH_LITERAL("local")) ||
  98       (extension_lower == FILE_PATH_LITERAL("lnk")))
  99     return true;
 100
 101   // http://www.juniper.net/security/auto/vulnerabilities/vuln2612.html
 102   // Files become magical if they end in a CLSID, so block such extensions.
 103   if (!extension_lower.empty() &&
 104       (extension_lower[0] == FILE_PATH_LITERAL('{')) &&
 105       (extension_lower[extension_lower.length() - 1] == FILE_PATH_LITERAL('}')))
 106     return true;
 107   return false;
 108 }
 109
 110 // Examines the current extension in |file_name| and modifies it if necessary in
 111 // order to ensure the filename is safe.  If |file_name| doesn't contain an
 112 // extension or if |ignore_extension| is true, then a new extension will be
 113 // constructed based on the |mime_type|.
 114 //
 115 // We're addressing two things here:
 116 //
 117 // 1) Usability.  If there is no reliable file extension, we want to guess a
 118 //    reasonable file extension based on the content type.
 119 //
 120 // 2) Shell integration.  Some file extensions automatically integrate with the
 121 //    shell.  We block these extensions to prevent a malicious web site from
 122 //    integrating with the user's shell.
 123 void EnsureSafeExtension(const std::string& mime_type,
 124                          bool ignore_extension,
 125                          base::FilePath* file_name) {
 126   // See if our file name already contains an extension.
 127   base::FilePath::StringType extension = file_name->Extension();
 128   if (!extension.empty())
 129     extension.erase(extension.begin());  // Erase preceding '.'.
 130
 131   if ((ignore_extension || extension.empty()) && !mime_type.empty()) {
 132     base::FilePath::StringType preferred_mime_extension;
 133     std::vector<base::FilePath::StringType> all_mime_extensions;
 134     GetPreferredExtensionForMimeType(mime_type, &preferred_mime_extension);
 135     GetExtensionsForMimeType(mime_type, &all_mime_extensions);
 136     // If the existing extension is in the list of valid extensions for the
 137     // given type, use it. This avoids doing things like pointlessly renaming
 138     // "foo.jpg" to "foo.jpeg".
 139     if (std::find(all_mime_extensions.begin(),
 140                   all_mime_extensions.end(),
 141                   extension) != all_mime_extensions.end()) {
 142       // leave |extension| alone
 143     } else if (!preferred_mime_extension.empty()) {
 144       extension = preferred_mime_extension;
 145     }
 146   }
 147
 148 #if defined(OS_WIN)
 149   static const base::FilePath::CharType default_extension[] =
 150       FILE_PATH_LITERAL("download");
 151
 152   // Rename shell-integrated extensions.
 153   // TODO(asanka): Consider stripping out the bad extension and replacing it
 154   // with the preferred extension for the MIME type if one is available.
 155   if (IsShellIntegratedExtension(extension))
 156     extension.assign(default_extension);
 157 #endif
 158
 159   *file_name = file_name->ReplaceExtension(extension);
 160 }
 161
 162 bool FilePathToString16(const base::FilePath& path, base::string16* converted) {
 163 #if defined(OS_WIN)
 164   *converted = path.value();
 165   return true;
 166 #elif defined(OS_POSIX)
 167   std::string component8 = path.AsUTF8Unsafe();
 168   return !component8.empty() &&
 169          base::UTF8ToUTF16(component8.c_str(), component8.size(), converted);
 170 #endif
 171 }
 172
 173 base::string16 GetSuggestedFilenameImpl(
 174     const GURL& url,
 175     const std::string& content_disposition,
 176     const std::string& referrer_charset,
 177     const std::string& suggested_name,
 178     const std::string& mime_type,
 179     const std::string& default_name,
 180     ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
 181   // TODO: this function to be updated to match the httpbis recommendations.
 182   // Talk to abarth for the latest news.
 183
 184   // We don't translate this fallback string, "download". If localization is
 185   // needed, the caller should provide localized fallback in |default_name|.
 186   static const base::FilePath::CharType kFinalFallbackName[] =
 187       FILE_PATH_LITERAL("download");
 188   std::string filename;  // In UTF-8
 189   bool overwrite_extension = false;
 190   bool is_name_from_content_disposition = false;
 191   // Try to extract a filename from content-disposition first.
 192   if (!content_disposition.empty()) {
 193     HttpContentDisposition header(content_disposition, referrer_charset);
 194     filename = header.filename();
 195     if (!filename.empty())
 196       is_name_from_content_disposition = true;
 197   }
 198
 199   // Then try to use the suggested name.
 200   if (filename.empty() && !suggested_name.empty())
 201     filename = suggested_name;
 202
 203   // Now try extracting the filename from the URL.  GetFileNameFromURL() only
 204   // looks at the last component of the URL and doesn't return the hostname as a
 205   // failover.
 206   if (filename.empty())
 207     filename = GetFileNameFromURL(url, referrer_charset, &overwrite_extension);
 208
 209   // Finally try the URL hostname, but only if there's no default specified in
 210   // |default_name|.  Some schemes (e.g.: file:, about:, data:) do not have a
 211   // host name.
 212   if (filename.empty() && default_name.empty() && url.is_valid() &&
 213       !url.host().empty()) {
 214     // TODO(jungshik) : Decode a 'punycoded' IDN hostname. (bug 1264451)
 215     filename = url.host();
 216   }
 217
 218   bool replace_trailing = false;
 219   base::FilePath::StringType result_str, default_name_str;
 220 #if defined(OS_WIN)
 221   replace_trailing = true;
 222   result_str = base::UTF8ToUTF16(filename);
 223   default_name_str = base::UTF8ToUTF16(default_name);
 224 #else
 225   result_str = filename;
 226   default_name_str = default_name;
 227 #endif
 228   SanitizeGeneratedFileName(&result_str, replace_trailing);
 229   if (result_str.find_last_not_of(FILE_PATH_LITERAL("-_")) ==
 230       base::FilePath::StringType::npos) {
 231     result_str = !default_name_str.empty()
 232                      ? default_name_str
 233                      : base::FilePath::StringType(kFinalFallbackName);
 234     overwrite_extension = false;
 235   }
 236   replace_illegal_characters_callback.Run(&result_str, '-');
 237   base::FilePath result(result_str);
 238   // extension should not appended to filename derived from
 239   // content-disposition, if it does not have one.
 240   // Hence mimetype and overwrite_extension values are not used.
 241   if (is_name_from_content_disposition)
 242     GenerateSafeFileName("", false, &result);
 243   else
 244     GenerateSafeFileName(mime_type, overwrite_extension, &result);
 245
 246   base::string16 result16;
 247   if (!FilePathToString16(result, &result16)) {
 248     result = base::FilePath(default_name_str);
 249     if (!FilePathToString16(result, &result16)) {
 250       result = base::FilePath(kFinalFallbackName);
 251       FilePathToString16(result, &result16);
 252     }
 253   }
 254   return result16;
 255 }
 256
 257 base::FilePath GenerateFileNameImpl(
 258     const GURL& url,
 259     const std::string& content_disposition,
 260     const std::string& referrer_charset,
 261     const std::string& suggested_name,
 262     const std::string& mime_type,
 263     const std::string& default_file_name,
 264     ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
 265   base::string16 file_name =
 266       GetSuggestedFilenameImpl(url,
 267                                content_disposition,
 268                                referrer_charset,
 269                                suggested_name,
 270                                mime_type,
 271                                default_file_name,
 272                                replace_illegal_characters_callback);
 273
 274 #if defined(OS_WIN)
 275   base::FilePath generated_name(file_name);
 276 #else
 277   base::FilePath generated_name(
 278       base::SysWideToNativeMB(base::UTF16ToWide(file_name)));
 279 #endif
 280
 281   DCHECK(!generated_name.empty());
 282
 283   return generated_name;
 284 }
 285
 286 }  // namespace net