net/base/filename_util_internal.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/base/filename_util.h"
   6
   7 #include "base/files/file_path.h"
   8 #include "base/files/file_util.h"
   9 #include "base/strings/string_util.h"
  10 #include "base/strings/sys_string_conversions.h"
  11 #include "base/strings/utf_string_conversions.h"
  12 #include "base/threading/thread_restrictions.h"
  13 #include "net/base/escape.h"
  14 #include "net/base/filename_util_internal.h"
  15 #include "net/base/mime_util.h"
  16 #include "net/base/net_string_util.h"
  17 #include "net/http/http_content_disposition.h"
  18 #include "url/gurl.h"
  19
  20 namespace net {
  21
  22 void SanitizeGeneratedFileName(base::FilePath::StringType* filename,
  23                                bool replace_trailing) {
  24   const base::FilePath::CharType kReplace[] = FILE_PATH_LITERAL("-");
  25   if (filename->empty())
  26     return;
  27   if (replace_trailing) {
  28     // Handle CreateFile() stripping trailing dots and spaces on filenames
  29     // http://support.microsoft.com/kb/115827
  30     size_t length = filename->size();
  31     size_t pos = filename->find_last_not_of(FILE_PATH_LITERAL(" ."));
  32     filename->resize((pos == std::string::npos) ? 0 : (pos + 1));
  33     base::TrimWhitespace(*filename, base::TRIM_TRAILING, filename);
  34     if (filename->empty())
  35       return;
  36     size_t trimmed = length - filename->size();
  37     if (trimmed)
  38       filename->insert(filename->end(), trimmed, kReplace[0]);
  39   }
  40   base::TrimString(*filename, FILE_PATH_LITERAL("."), filename);
  41   if (filename->empty())
  42     return;
  43   // Replace any path information by changing path separators.
  44   base::ReplaceSubstringsAfterOffset(
  45       filename, 0, FILE_PATH_LITERAL("/"), kReplace);
  46   base::ReplaceSubstringsAfterOffset(
  47       filename, 0, FILE_PATH_LITERAL("\\"), kReplace);
  48 }
  49
  50 // Returns the filename determined from the last component of the path portion
  51 // of the URL.  Returns an empty string if the URL doesn't have a path or is
  52 // invalid. If the generated filename is not reliable,
  53 // |should_overwrite_extension| will be set to true, in which case a better
  54 // extension should be determined based on the content type.
  55 std::string GetFileNameFromURL(const GURL& url,
  56                                const std::string& referrer_charset,
  57                                bool* should_overwrite_extension) {
  58   // about: and data: URLs don't have file names, but esp. data: URLs may
  59   // contain parts that look like ones (i.e., contain a slash).  Therefore we
  60   // don't attempt to divine a file name out of them.
  61   if (!url.is_valid() || url.SchemeIs("about") || url.SchemeIs("data"))
  62     return std::string();
  63
  64   const std::string unescaped_url_filename = UnescapeURLComponent(
  65       url.ExtractFileName(),
  66       UnescapeRule::SPACES | UnescapeRule::URL_SPECIAL_CHARS);
  67
  68   // The URL's path should be escaped UTF-8, but may not be.
  69   std::string decoded_filename = unescaped_url_filename;
  70   if (!base::IsStringUTF8(decoded_filename)) {
  71     // TODO(jshin): this is probably not robust enough. To be sure, we need
  72     // encoding detection.
  73     base::string16 utf16_output;
  74     if (!referrer_charset.empty() &&
  75         ConvertToUTF16(unescaped_url_filename, referrer_charset.c_str(),
  76                        &utf16_output)) {
  77       decoded_filename = base::UTF16ToUTF8(utf16_output);
  78     } else {
  79       decoded_filename =
  80           base::WideToUTF8(base::SysNativeMBToWide(unescaped_url_filename));
  81     }
  82   }
  83   // If the URL contains a (possibly empty) query, assume it is a generator, and
  84   // allow the determined extension to be overwritten.
  85   *should_overwrite_extension = !decoded_filename.empty() && url.has_query();
  86
  87   return decoded_filename;
  88 }
  89
  90 // Returns whether the specified extension is automatically integrated into the
  91 // windows shell.
  92 bool IsShellIntegratedExtension(const base::FilePath::StringType& extension) {
  93   base::FilePath::StringType extension_lower =
  94       base::StringToLowerASCII(extension);
  95
  96   // http://msdn.microsoft.com/en-us/library/ms811694.aspx
  97   // Right-clicking on shortcuts can be magical.
  98   if ((extension_lower == FILE_PATH_LITERAL("local")) ||
  99       (extension_lower == FILE_PATH_LITERAL("lnk")))
 100     return true;
 101
 102   // http://www.juniper.net/security/auto/vulnerabilities/vuln2612.html
 103   // Files become magical if they end in a CLSID, so block such extensions.
 104   if (!extension_lower.empty() &&
 105       (extension_lower[0] == FILE_PATH_LITERAL('{')) &&
 106       (extension_lower[extension_lower.length() - 1] == FILE_PATH_LITERAL('}')))
 107     return true;
 108   return false;
 109 }
 110
 111 // Returns whether the specified file name is a reserved name on windows.
 112 // This includes names like "com2.zip" (which correspond to devices) and
 113 // desktop.ini and thumbs.db which have special meaning to the windows shell.
 114 bool IsReservedName(const base::FilePath::StringType& filename) {
 115   // This list is taken from the MSDN article "Naming a file"
 116   // http://msdn2.microsoft.com/en-us/library/aa365247(VS.85).aspx
 117   // I also added clock$ because GetSaveFileName seems to consider it as a
 118   // reserved name too.
 119   static const char* const known_devices[] = {
 120       "con",  "prn",  "aux",  "nul",  "com1", "com2", "com3",  "com4",
 121       "com5", "com6", "com7", "com8", "com9", "lpt1", "lpt2",  "lpt3",
 122       "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9", "clock$"};
 123 #if defined(OS_WIN)
 124   std::string filename_lower =
 125       base::StringToLowerASCII(base::WideToUTF8(filename));
 126 #elif defined(OS_POSIX)
 127   std::string filename_lower = base::StringToLowerASCII(filename);
 128 #endif
 129
 130   for (size_t i = 0; i < arraysize(known_devices); ++i) {
 131     // Exact match.
 132     if (filename_lower == known_devices[i])
 133       return true;
 134     // Starts with "DEVICE.".
 135     if (filename_lower.find(std::string(known_devices[i]) + ".") == 0)
 136       return true;
 137   }
 138
 139   static const char* const magic_names[] = {
 140     // These file names are used by the "Customize folder" feature of the shell.
 141     "desktop.ini",
 142     "thumbs.db",
 143   };
 144
 145   for (size_t i = 0; i < arraysize(magic_names); ++i) {
 146     if (filename_lower == magic_names[i])
 147       return true;
 148   }
 149
 150   return false;
 151 }
 152
 153 // Examines the current extension in |file_name| and modifies it if necessary in
 154 // order to ensure the filename is safe.  If |file_name| doesn't contain an
 155 // extension or if |ignore_extension| is true, then a new extension will be
 156 // constructed based on the |mime_type|.
 157 //
 158 // We're addressing two things here:
 159 //
 160 // 1) Usability.  If there is no reliable file extension, we want to guess a
 161 //    reasonable file extension based on the content type.
 162 //
 163 // 2) Shell integration.  Some file extensions automatically integrate with the
 164 //    shell.  We block these extensions to prevent a malicious web site from
 165 //    integrating with the user's shell.
 166 void EnsureSafeExtension(const std::string& mime_type,
 167                          bool ignore_extension,
 168                          base::FilePath* file_name) {
 169   // See if our file name already contains an extension.
 170   base::FilePath::StringType extension = file_name->Extension();
 171   if (!extension.empty())
 172     extension.erase(extension.begin());  // Erase preceding '.'.
 173
 174   if ((ignore_extension || extension.empty()) && !mime_type.empty()) {
 175     base::FilePath::StringType preferred_mime_extension;
 176     std::vector<base::FilePath::StringType> all_mime_extensions;
 177     GetPreferredExtensionForMimeType(mime_type, &preferred_mime_extension);
 178     GetExtensionsForMimeType(mime_type, &all_mime_extensions);
 179     // If the existing extension is in the list of valid extensions for the
 180     // given type, use it. This avoids doing things like pointlessly renaming
 181     // "foo.jpg" to "foo.jpeg".
 182     if (std::find(all_mime_extensions.begin(),
 183                   all_mime_extensions.end(),
 184                   extension) != all_mime_extensions.end()) {
 185       // leave |extension| alone
 186     } else if (!preferred_mime_extension.empty()) {
 187       extension = preferred_mime_extension;
 188     }
 189   }
 190
 191 #if defined(OS_WIN)
 192   static const base::FilePath::CharType default_extension[] =
 193       FILE_PATH_LITERAL("download");
 194
 195   // Rename shell-integrated extensions.
 196   // TODO(asanka): Consider stripping out the bad extension and replacing it
 197   // with the preferred extension for the MIME type if one is available.
 198   if (IsShellIntegratedExtension(extension))
 199     extension.assign(default_extension);
 200 #endif
 201
 202   *file_name = file_name->ReplaceExtension(extension);
 203 }
 204
 205 bool FilePathToString16(const base::FilePath& path, base::string16* converted) {
 206 #if defined(OS_WIN)
 207   *converted = path.value();
 208   return true;
 209 #elif defined(OS_POSIX)
 210   std::string component8 = path.AsUTF8Unsafe();
 211   return !component8.empty() &&
 212          base::UTF8ToUTF16(component8.c_str(), component8.size(), converted);
 213 #endif
 214 }
 215
 216 base::string16 GetSuggestedFilenameImpl(
 217     const GURL& url,
 218     const std::string& content_disposition,
 219     const std::string& referrer_charset,
 220     const std::string& suggested_name,
 221     const std::string& mime_type,
 222     const std::string& default_name,
 223     ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
 224   // TODO: this function to be updated to match the httpbis recommendations.
 225   // Talk to abarth for the latest news.
 226
 227   // We don't translate this fallback string, "download". If localization is
 228   // needed, the caller should provide localized fallback in |default_name|.
 229   static const base::FilePath::CharType kFinalFallbackName[] =
 230       FILE_PATH_LITERAL("download");
 231   std::string filename;  // In UTF-8
 232   bool overwrite_extension = false;
 233   bool is_name_from_content_disposition = false;
 234   // Try to extract a filename from content-disposition first.
 235   if (!content_disposition.empty()) {
 236     HttpContentDisposition header(content_disposition, referrer_charset);
 237     filename = header.filename();
 238     if (!filename.empty())
 239       is_name_from_content_disposition = true;
 240   }
 241
 242   // Then try to use the suggested name.
 243   if (filename.empty() && !suggested_name.empty())
 244     filename = suggested_name;
 245
 246   // Now try extracting the filename from the URL.  GetFileNameFromURL() only
 247   // looks at the last component of the URL and doesn't return the hostname as a
 248   // failover.
 249   if (filename.empty())
 250     filename = GetFileNameFromURL(url, referrer_charset, &overwrite_extension);
 251
 252   // Finally try the URL hostname, but only if there's no default specified in
 253   // |default_name|.  Some schemes (e.g.: file:, about:, data:) do not have a
 254   // host name.
 255   if (filename.empty() && default_name.empty() && url.is_valid() &&
 256       !url.host().empty()) {
 257     // TODO(jungshik) : Decode a 'punycoded' IDN hostname. (bug 1264451)
 258     filename = url.host();
 259   }
 260
 261   bool replace_trailing = false;
 262   base::FilePath::StringType result_str, default_name_str;
 263 #if defined(OS_WIN)
 264   replace_trailing = true;
 265   result_str = base::UTF8ToUTF16(filename);
 266   default_name_str = base::UTF8ToUTF16(default_name);
 267 #else
 268   result_str = filename;
 269   default_name_str = default_name;
 270 #endif
 271   SanitizeGeneratedFileName(&result_str, replace_trailing);
 272   if (result_str.find_last_not_of(FILE_PATH_LITERAL("-_")) ==
 273       base::FilePath::StringType::npos) {
 274     result_str = !default_name_str.empty()
 275                      ? default_name_str
 276                      : base::FilePath::StringType(kFinalFallbackName);
 277     overwrite_extension = false;
 278   }
 279   replace_illegal_characters_callback.Run(&result_str, '-');
 280   base::FilePath result(result_str);
 281   // extension should not appended to filename derived from
 282   // content-disposition, if it does not have one.
 283   // Hence mimetype and overwrite_extension values are not used.
 284   if (is_name_from_content_disposition)
 285     GenerateSafeFileName("", false, &result);
 286   else
 287     GenerateSafeFileName(mime_type, overwrite_extension, &result);
 288
 289   base::string16 result16;
 290   if (!FilePathToString16(result, &result16)) {
 291     result = base::FilePath(default_name_str);
 292     if (!FilePathToString16(result, &result16)) {
 293       result = base::FilePath(kFinalFallbackName);
 294       FilePathToString16(result, &result16);
 295     }
 296   }
 297   return result16;
 298 }
 299
 300 base::FilePath GenerateFileNameImpl(
 301     const GURL& url,
 302     const std::string& content_disposition,
 303     const std::string& referrer_charset,
 304     const std::string& suggested_name,
 305     const std::string& mime_type,
 306     const std::string& default_file_name,
 307     ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
 308   base::string16 file_name =
 309       GetSuggestedFilenameImpl(url,
 310                                content_disposition,
 311                                referrer_charset,
 312                                suggested_name,
 313                                mime_type,
 314                                default_file_name,
 315                                replace_illegal_characters_callback);
 316
 317 #if defined(OS_WIN)
 318   base::FilePath generated_name(file_name);
 319 #else
 320   base::FilePath generated_name(
 321       base::SysWideToNativeMB(base::UTF16ToWide(file_name)));
 322 #endif
 323
 324   DCHECK(!generated_name.empty());
 325
 326   return generated_name;
 327 }
 328
 329 }  // namespace net