chrome/browser/extensions/sandboxed_unpacker.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
   6 #define CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
   7
   8 #include <string>
   9
  10 #include "base/files/file_path.h"
  11 #include "base/files/scoped_temp_dir.h"
  12 #include "base/memory/ref_counted.h"
  13 #include "base/time.h"
  14 #include "chrome/common/extensions/manifest.h"
  15 #include "content/public/browser/utility_process_host_client.h"
  16
  17 namespace base {
  18 class DictionaryValue;
  19 class SequencedTaskRunner;
  20 }
  21
  22 namespace extensions {
  23 class Extension;
  24
  25 class SandboxedUnpackerClient
  26     : public base::RefCountedThreadSafe<SandboxedUnpackerClient> {
  27  public:
  28   // temp_dir - A temporary directory containing the results of the extension
  29   // unpacking. The client is responsible for deleting this directory.
  30   //
  31   // extension_root - The path to the extension root inside of temp_dir.
  32   //
  33   // original_manifest - The parsed but unmodified version of the manifest,
  34   // with no modifications such as localization, etc.
  35   //
  36   // extension - The extension that was unpacked. The client is responsible
  37   // for deleting this memory.
  38   virtual void OnUnpackSuccess(const base::FilePath& temp_dir,
  39                                const base::FilePath& extension_root,
  40                                const base::DictionaryValue* original_manifest,
  41                                const Extension* extension) = 0;
  42   virtual void OnUnpackFailure(const string16& error) = 0;
  43
  44  protected:
  45   friend class base::RefCountedThreadSafe<SandboxedUnpackerClient>;
  46
  47   virtual ~SandboxedUnpackerClient() {}
  48 };
  49
  50 // SandboxedUnpacker unpacks extensions from the CRX format into a
  51 // directory. This is done in a sandboxed subprocess to protect the browser
  52 // process from parsing complex formats like JPEG or JSON from untrusted
  53 // sources.
  54 //
  55 // Unpacking an extension using this class makes minor changes to its source,
  56 // such as transcoding all images to PNG, parsing all message catalogs
  57 // and rewriting the manifest JSON. As such, it should not be used when the
  58 // output is not intended to be given back to the author.
  59 //
  60 //
  61 // Lifetime management:
  62 //
  63 // This class is ref-counted by each call it makes to itself on another thread,
  64 // and by UtilityProcessHost.
  65 //
  66 // Additionally, we hold a reference to our own client so that it lives at least
  67 // long enough to receive the result of unpacking.
  68 //
  69 //
  70 // NOTE: This class should only be used on the file thread.
  71 class SandboxedUnpacker : public content::UtilityProcessHostClient {
  72  public:
  73   // Unpacks the extension in |crx_path| into a temporary directory and calls
  74   // |client| with the result. If |run_out_of_process| is provided, unpacking
  75   // is done in a sandboxed subprocess. Otherwise, it is done in-process.
  76   SandboxedUnpacker(const base::FilePath& crx_path,
  77                     bool run_out_of_process,
  78                     Manifest::Location location,
  79                     int creation_flags,
  80                     const base::FilePath& extensions_dir,
  81                     base::SequencedTaskRunner* unpacker_io_task_runner,
  82                     SandboxedUnpackerClient* client);
  83
  84   // Start unpacking the extension. The client is called with the results.
  85   void Start();
  86
  87  private:
  88   class ProcessHostClient;
  89
  90   // Enumerate all the ways unpacking can fail.  Calls to ReportFailure()
  91   // take a failure reason as an argument, and put it in histogram
  92   // Extensions.SandboxUnpackFailureReason.
  93   enum FailureReason {
  94     // SandboxedUnpacker::CreateTempDirectory()
  95     COULD_NOT_GET_TEMP_DIRECTORY,
  96     COULD_NOT_CREATE_TEMP_DIRECTORY,
  97
  98     // SandboxedUnpacker::Start()
  99     FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY,
 100     COULD_NOT_GET_SANDBOX_FRIENDLY_PATH,
 101
 102     // SandboxedUnpacker::OnUnpackExtensionSucceeded()
 103     COULD_NOT_LOCALIZE_EXTENSION,
 104     INVALID_MANIFEST,
 105
 106     // SandboxedUnpacker::OnUnpackExtensionFailed()
 107     UNPACKER_CLIENT_FAILED,
 108
 109     // SandboxedUnpacker::OnProcessCrashed()
 110     UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL,
 111
 112     // SandboxedUnpacker::ValidateSignature()
 113     CRX_FILE_NOT_READABLE,
 114     CRX_HEADER_INVALID,
 115     CRX_MAGIC_NUMBER_INVALID,
 116     CRX_VERSION_NUMBER_INVALID,
 117     CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE,
 118     CRX_ZERO_KEY_LENGTH,
 119     CRX_ZERO_SIGNATURE_LENGTH,
 120     CRX_PUBLIC_KEY_INVALID,
 121     CRX_SIGNATURE_INVALID,
 122     CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED,
 123     CRX_SIGNATURE_VERIFICATION_FAILED,
 124
 125     // SandboxedUnpacker::RewriteManifestFile()
 126     ERROR_SERIALIZING_MANIFEST_JSON,
 127     ERROR_SAVING_MANIFEST_JSON,
 128
 129     // SandboxedUnpacker::RewriteImageFiles()
 130     COULD_NOT_READ_IMAGE_DATA_FROM_DISK,
 131     DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST,
 132     INVALID_PATH_FOR_BROWSER_IMAGE,
 133     ERROR_REMOVING_OLD_IMAGE_FILE,
 134     INVALID_PATH_FOR_BITMAP_IMAGE,
 135     ERROR_RE_ENCODING_THEME_IMAGE,
 136     ERROR_SAVING_THEME_IMAGE,
 137
 138     // SandboxedUnpacker::RewriteCatalogFiles()
 139     COULD_NOT_READ_CATALOG_DATA_FROM_DISK,
 140     INVALID_CATALOG_DATA,
 141     INVALID_PATH_FOR_CATALOG,
 142     ERROR_SERIALIZING_CATALOG,
 143     ERROR_SAVING_CATALOG,
 144
 145     NUM_FAILURE_REASONS
 146   };
 147
 148   friend class ProcessHostClient;
 149   friend class SandboxedUnpackerTest;
 150
 151   virtual ~SandboxedUnpacker();
 152
 153   // Set |temp_dir_| as a temporary directory to unpack the extension in.
 154   // Return true on success.
 155   virtual bool CreateTempDirectory();
 156
 157   // Validates the signature of the extension and extract the key to
 158   // |public_key_|. Returns true if the signature validates, false otherwise.
 159   //
 160   // NOTE: Having this method here is a bit ugly. This code should really live
 161   // in extensions::Unpacker as it is not specific to sandboxed unpacking. It
 162   // was put here because we cannot run windows crypto code in the sandbox. But
 163   // we could still have this method statically on extensions::Unpacker so that
 164   // code just for unpacking is there and code just for sandboxing of unpacking
 165   // is here.
 166   bool ValidateSignature();
 167
 168   // Starts the utility process that unpacks our extension.
 169   void StartProcessOnIOThread(const base::FilePath& temp_crx_path);
 170
 171   // UtilityProcessHostClient
 172   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 173   virtual void OnProcessCrashed(int exit_code) OVERRIDE;
 174
 175   // IPC message handlers.
 176   void OnUnpackExtensionSucceeded(const base::DictionaryValue& manifest);
 177   void OnUnpackExtensionFailed(const string16& error_message);
 178
 179   void ReportFailure(FailureReason reason, const string16& message);
 180   void ReportSuccess(const base::DictionaryValue& original_manifest);
 181
 182   // Overwrites original manifest with safe result from utility process.
 183   // Returns NULL on error. Caller owns the returned object.
 184   base::DictionaryValue* RewriteManifestFile(
 185       const base::DictionaryValue& manifest);
 186
 187   // Overwrites original files with safe results from utility process.
 188   // Reports error and returns false if it fails.
 189   bool RewriteImageFiles();
 190   bool RewriteCatalogFiles();
 191
 192   // Cleans up temp directory artifacts.
 193   void Cleanup();
 194
 195   // The path to the CRX to unpack.
 196   base::FilePath crx_path_;
 197
 198   // True if unpacking should be done by the utility process.
 199   bool run_out_of_process_;
 200
 201   // Our client.
 202   scoped_refptr<SandboxedUnpackerClient> client_;
 203
 204   // The Extensions directory inside the profile.
 205   base::FilePath extensions_dir_;
 206
 207   // A temporary directory to use for unpacking.
 208   base::ScopedTempDir temp_dir_;
 209
 210   // The root directory of the unpacked extension. This is a child of temp_dir_.
 211   base::FilePath extension_root_;
 212
 213   // Represents the extension we're unpacking.
 214   scoped_refptr<Extension> extension_;
 215
 216   // Whether we've received a response from the utility process yet.
 217   bool got_response_;
 218
 219   // The public key that was extracted from the CRX header.
 220   std::string public_key_;
 221
 222   // The extension's ID. This will be calculated from the public key in the crx
 223   // header.
 224   std::string extension_id_;
 225
 226   // Time at which unpacking started. Used to compute the time unpacking takes.
 227   base::TimeTicks unpack_start_time_;
 228
 229   // Location to use for the unpacked extension.
 230   Manifest::Location location_;
 231
 232   // Creation flags to use for the extension.  These flags will be used
 233   // when calling Extenion::Create() by the crx installer.
 234   int creation_flags_;
 235
 236   // Sequenced task runner where file I/O operations will be performed at.
 237   scoped_refptr<base::SequencedTaskRunner> unpacker_io_task_runner_;
 238 };
 239
 240 }  // namespace extensions
 241
 242 #endif  // CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_