extensions/common/file_util.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "extensions/common/file_util.h"
   6
   7 #include <map>
   8 #include <set>
   9 #include <string>
  10 #include <utility>
  11 #include <vector>
  12
  13 #include "base/files/file_enumerator.h"
  14 #include "base/files/file_path.h"
  15 #include "base/files/file_util.h"
  16 #include "base/files/scoped_temp_dir.h"
  17 #include "base/json/json_file_value_serializer.h"
  18 #include "base/logging.h"
  19 #include "base/memory/scoped_ptr.h"
  20 #include "base/metrics/field_trial.h"
  21 #include "base/metrics/histogram.h"
  22 #include "base/strings/stringprintf.h"
  23 #include "base/strings/utf_string_conversions.h"
  24 #include "base/threading/thread_restrictions.h"
  25 #include "base/time/time.h"
  26 #include "extensions/common/constants.h"
  27 #include "extensions/common/extension.h"
  28 #include "extensions/common/extension_icon_set.h"
  29 #include "extensions/common/extension_l10n_util.h"
  30 #include "extensions/common/extension_set.h"
  31 #include "extensions/common/install_warning.h"
  32 #include "extensions/common/manifest.h"
  33 #include "extensions/common/manifest_constants.h"
  34 #include "extensions/common/manifest_handler.h"
  35 #include "extensions/common/manifest_handlers/default_locale_handler.h"
  36 #include "extensions/common/manifest_handlers/icons_handler.h"
  37 #include "extensions/common/manifest_handlers/shared_module_info.h"
  38 #include "grit/extensions_strings.h"
  39 #include "net/base/escape.h"
  40 #include "ui/base/l10n/l10n_util.h"
  41 #include "url/gurl.h"
  42
  43 namespace extensions {
  44 namespace file_util {
  45 namespace {
  46
  47 // Returns true if the given file path exists and is not zero-length.
  48 bool ValidateFilePath(const base::FilePath& path) {
  49   int64 size = 0;
  50   if (!base::PathExists(path) ||
  51       !base::GetFileSize(path, &size) ||
  52       size == 0) {
  53     return false;
  54   }
  55
  56   return true;
  57 }
  58
  59 // Returns true if the extension installation should flush all files and the
  60 // directory.
  61 bool UseSafeInstallation() {
  62   const char kFieldTrialName[] = "ExtensionUseSafeInstallation";
  63   const char kEnable[] = "Enable";
  64   return base::FieldTrialList::FindFullName(kFieldTrialName) == kEnable;
  65 }
  66
  67 enum FlushOneOrAllFiles {
  68    ONE_FILE_ONLY,
  69    ALL_FILES
  70 };
  71
  72 // Flush all files in a directory or just one.  When flushing all files, it
  73 // makes sure every file is on disk.  When flushing one file only, it ensures
  74 // all parent directories are on disk.
  75 void FlushFilesInDir(const base::FilePath& path,
  76                      FlushOneOrAllFiles one_or_all_files) {
  77   if (!UseSafeInstallation()) {
  78     return;
  79   }
  80   base::FileEnumerator temp_traversal(path,
  81                                       true,  // recursive
  82                                       base::FileEnumerator::FILES);
  83   for (base::FilePath current = temp_traversal.Next(); !current.empty();
  84       current = temp_traversal.Next()) {
  85     base::File currentFile(current,
  86                            base::File::FLAG_OPEN | base::File::FLAG_WRITE);
  87     currentFile.Flush();
  88     currentFile.Close();
  89     if (one_or_all_files == ONE_FILE_ONLY) {
  90       break;
  91     }
  92   }
  93 }
  94
  95 }  // namespace
  96
  97 const base::FilePath::CharType kTempDirectoryName[] = FILE_PATH_LITERAL("Temp");
  98
  99 base::FilePath InstallExtension(const base::FilePath& unpacked_source_dir,
 100                                 const std::string& id,
 101                                 const std::string& version,
 102                                 const base::FilePath& extensions_dir) {
 103   base::FilePath extension_dir = extensions_dir.AppendASCII(id);
 104   base::FilePath version_dir;
 105
 106   // Create the extension directory if it doesn't exist already.
 107   if (!base::PathExists(extension_dir)) {
 108     if (!base::CreateDirectory(extension_dir))
 109       return base::FilePath();
 110   }
 111
 112   // Get a temp directory on the same file system as the profile.
 113   base::FilePath install_temp_dir = GetInstallTempDir(extensions_dir);
 114   base::ScopedTempDir extension_temp_dir;
 115   if (install_temp_dir.empty() ||
 116       !extension_temp_dir.CreateUniqueTempDirUnderPath(install_temp_dir)) {
 117     LOG(ERROR) << "Creating of temp dir under in the profile failed.";
 118     return base::FilePath();
 119   }
 120   base::FilePath crx_temp_source =
 121       extension_temp_dir.path().Append(unpacked_source_dir.BaseName());
 122   if (!base::Move(unpacked_source_dir, crx_temp_source)) {
 123     LOG(ERROR) << "Moving extension from : " << unpacked_source_dir.value()
 124                << " to : " << crx_temp_source.value() << " failed.";
 125     return base::FilePath();
 126   }
 127
 128   // Try to find a free directory. There can be legitimate conflicts in the case
 129   // of overinstallation of the same version.
 130   const int kMaxAttempts = 100;
 131   for (int i = 0; i < kMaxAttempts; ++i) {
 132     base::FilePath candidate = extension_dir.AppendASCII(
 133         base::StringPrintf("%s_%u", version.c_str(), i));
 134     if (!base::PathExists(candidate)) {
 135       version_dir = candidate;
 136       break;
 137     }
 138   }
 139
 140   if (version_dir.empty()) {
 141     LOG(ERROR) << "Could not find a home for extension " << id << " with "
 142                << "version " << version << ".";
 143     return base::FilePath();
 144   }
 145
 146   base::TimeTicks start_time = base::TimeTicks::Now();
 147
 148   // Flush the source dir completely before moving to make sure everything is
 149   // on disk. Otherwise a sudden power loss could cause the newly installed
 150   // extension to be in a corrupted state. Note that empty sub-directories
 151   // may still be lost.
 152   FlushFilesInDir(crx_temp_source, ALL_FILES);
 153
 154   // The target version_dir does not exists yet, so base::Move() is using
 155   // rename() on POSIX systems. It is atomic in the sense that it will
 156   // either complete successfully or in the event of data loss be reverted.
 157   if (!base::Move(crx_temp_source, version_dir)) {
 158     LOG(ERROR) << "Installing extension from : " << crx_temp_source.value()
 159                << " into : " << version_dir.value() << " failed.";
 160     return base::FilePath();
 161   }
 162
 163   // Flush one file in the new version_dir to make sure the dir move above is
 164   // persisted on disk. This is guaranteed on POSIX systems. ExtensionPrefs
 165   // is going to be updated with the new version_dir later. In the event of
 166   // data loss ExtensionPrefs should be pointing to the previous version which
 167   // is still fine.
 168   FlushFilesInDir(version_dir, ONE_FILE_ONLY);
 169
 170   UMA_HISTOGRAM_TIMES("Extensions.FileInstallation",
 171                       base::TimeTicks::Now() - start_time);
 172
 173   return version_dir;
 174 }
 175
 176 void UninstallExtension(const base::FilePath& extensions_dir,
 177                         const std::string& id) {
 178   // We don't care about the return value. If this fails (and it can, due to
 179   // plugins that aren't unloaded yet), it will get cleaned up by
 180   // ExtensionGarbageCollector::GarbageCollectExtensions.
 181   base::DeleteFile(extensions_dir.AppendASCII(id), true);  // recursive.
 182 }
 183
 184 scoped_refptr<Extension> LoadExtension(const base::FilePath& extension_path,
 185                                        Manifest::Location location,
 186                                        int flags,
 187                                        std::string* error) {
 188   return LoadExtension(extension_path, std::string(), location, flags, error);
 189 }
 190
 191 scoped_refptr<Extension> LoadExtension(const base::FilePath& extension_path,
 192                                        const std::string& extension_id,
 193                                        Manifest::Location location,
 194                                        int flags,
 195                                        std::string* error) {
 196   scoped_ptr<base::DictionaryValue> manifest(
 197       LoadManifest(extension_path, error));
 198   if (!manifest.get())
 199     return NULL;
 200   if (!extension_l10n_util::LocalizeExtension(
 201           extension_path, manifest.get(), error)) {
 202     return NULL;
 203   }
 204
 205   scoped_refptr<Extension> extension(Extension::Create(
 206       extension_path, location, *manifest, flags, extension_id, error));
 207   if (!extension.get())
 208     return NULL;
 209
 210   std::vector<InstallWarning> warnings;
 211   if (!ValidateExtension(extension.get(), error, &warnings))
 212     return NULL;
 213   extension->AddInstallWarnings(warnings);
 214
 215   return extension;
 216 }
 217
 218 base::DictionaryValue* LoadManifest(const base::FilePath& extension_path,
 219                                     std::string* error) {
 220   return LoadManifest(extension_path, kManifestFilename, error);
 221 }
 222
 223 base::DictionaryValue* LoadManifest(
 224     const base::FilePath& extension_path,
 225     const base::FilePath::CharType* manifest_filename,
 226     std::string* error) {
 227   base::FilePath manifest_path = extension_path.Append(manifest_filename);
 228   if (!base::PathExists(manifest_path)) {
 229     *error = l10n_util::GetStringUTF8(IDS_EXTENSION_MANIFEST_UNREADABLE);
 230     return NULL;
 231   }
 232
 233   JSONFileValueDeserializer deserializer(manifest_path);
 234   scoped_ptr<base::Value> root(deserializer.Deserialize(NULL, error));
 235   if (!root.get()) {
 236     if (error->empty()) {
 237       // If |error| is empty, than the file could not be read.
 238       // It would be cleaner to have the JSON reader give a specific error
 239       // in this case, but other code tests for a file error with
 240       // error->empty().  For now, be consistent.
 241       *error = l10n_util::GetStringUTF8(IDS_EXTENSION_MANIFEST_UNREADABLE);
 242     } else {
 243       *error = base::StringPrintf(
 244           "%s  %s", manifest_errors::kManifestParseError, error->c_str());
 245     }
 246     return NULL;
 247   }
 248
 249   if (!root->IsType(base::Value::TYPE_DICTIONARY)) {
 250     *error = l10n_util::GetStringUTF8(IDS_EXTENSION_MANIFEST_INVALID);
 251     return NULL;
 252   }
 253
 254   return static_cast<base::DictionaryValue*>(root.release());
 255 }
 256
 257 bool ValidateExtension(const Extension* extension,
 258                        std::string* error,
 259                        std::vector<InstallWarning>* warnings) {
 260   // Ask registered manifest handlers to validate their paths.
 261   if (!ManifestHandler::ValidateExtension(extension, error, warnings))
 262     return false;
 263
 264   // Check children of extension root to see if any of them start with _ and is
 265   // not on the reserved list. We only warn, and do not block the loading of the
 266   // extension.
 267   std::string warning;
 268   if (!CheckForIllegalFilenames(extension->path(), &warning))
 269     warnings->push_back(InstallWarning(warning));
 270
 271   // Check that extensions don't include private key files.
 272   std::vector<base::FilePath> private_keys =
 273       FindPrivateKeyFiles(extension->path());
 274   if (extension->creation_flags() & Extension::ERROR_ON_PRIVATE_KEY) {
 275     if (!private_keys.empty()) {
 276       // Only print one of the private keys because l10n_util doesn't have a way
 277       // to translate a list of strings.
 278       *error =
 279           l10n_util::GetStringFUTF8(IDS_EXTENSION_CONTAINS_PRIVATE_KEY,
 280                                     private_keys.front().LossyDisplayName());
 281       return false;
 282     }
 283   } else {
 284     for (size_t i = 0; i < private_keys.size(); ++i) {
 285       warnings->push_back(InstallWarning(
 286           l10n_util::GetStringFUTF8(IDS_EXTENSION_CONTAINS_PRIVATE_KEY,
 287                                     private_keys[i].LossyDisplayName())));
 288     }
 289     // Only warn; don't block loading the extension.
 290   }
 291   return true;
 292 }
 293
 294 std::vector<base::FilePath> FindPrivateKeyFiles(
 295     const base::FilePath& extension_dir) {
 296   std::vector<base::FilePath> result;
 297   // Pattern matching only works at the root level, so filter manually.
 298   base::FileEnumerator traversal(
 299       extension_dir, /*recursive=*/true, base::FileEnumerator::FILES);
 300   for (base::FilePath current = traversal.Next(); !current.empty();
 301        current = traversal.Next()) {
 302     if (!current.MatchesExtension(kExtensionKeyFileExtension))
 303       continue;
 304
 305     std::string key_contents;
 306     if (!base::ReadFileToString(current, &key_contents)) {
 307       // If we can't read the file, assume it's not a private key.
 308       continue;
 309     }
 310     std::string key_bytes;
 311     if (!Extension::ParsePEMKeyBytes(key_contents, &key_bytes)) {
 312       // If we can't parse the key, assume it's ok too.
 313       continue;
 314     }
 315
 316     result.push_back(current);
 317   }
 318   return result;
 319 }
 320
 321 bool CheckForIllegalFilenames(const base::FilePath& extension_path,
 322                               std::string* error) {
 323   // Reserved underscore names.
 324   static const base::FilePath::CharType* reserved_names[] = {
 325       kLocaleFolder, kPlatformSpecificFolder, FILE_PATH_LITERAL("__MACOSX"), };
 326   CR_DEFINE_STATIC_LOCAL(
 327       std::set<base::FilePath::StringType>,
 328       reserved_underscore_names,
 329       (reserved_names, reserved_names + arraysize(reserved_names)));
 330
 331   // Enumerate all files and directories in the extension root.
 332   // There is a problem when using pattern "_*" with FileEnumerator, so we have
 333   // to cheat with find_first_of and match all.
 334   const int kFilesAndDirectories =
 335       base::FileEnumerator::DIRECTORIES | base::FileEnumerator::FILES;
 336   base::FileEnumerator all_files(extension_path, false, kFilesAndDirectories);
 337
 338   base::FilePath file;
 339   while (!(file = all_files.Next()).empty()) {
 340     base::FilePath::StringType filename = file.BaseName().value();
 341     // Skip all that don't start with "_".
 342     if (filename.find_first_of(FILE_PATH_LITERAL("_")) != 0)
 343       continue;
 344     if (reserved_underscore_names.find(filename) ==
 345         reserved_underscore_names.end()) {
 346       *error = base::StringPrintf(
 347           "Cannot load extension with file or directory name %s. "
 348           "Filenames starting with \"_\" are reserved for use by the system.",
 349           file.BaseName().AsUTF8Unsafe().c_str());
 350       return false;
 351     }
 352   }
 353
 354   return true;
 355 }
 356
 357 base::FilePath GetInstallTempDir(const base::FilePath& extensions_dir) {
 358   // We do file IO in this function, but only when the current profile's
 359   // Temp directory has never been used before, or in a rare error case.
 360   // Developers are not likely to see these situations often, so do an
 361   // explicit thread check.
 362   base::ThreadRestrictions::AssertIOAllowed();
 363
 364   // Create the temp directory as a sub-directory of the Extensions directory.
 365   // This guarantees it is on the same file system as the extension's eventual
 366   // install target.
 367   base::FilePath temp_path = extensions_dir.Append(kTempDirectoryName);
 368   if (base::PathExists(temp_path)) {
 369     if (!base::DirectoryExists(temp_path)) {
 370       DLOG(WARNING) << "Not a directory: " << temp_path.value();
 371       return base::FilePath();
 372     }
 373     if (!base::PathIsWritable(temp_path)) {
 374       DLOG(WARNING) << "Can't write to path: " << temp_path.value();
 375       return base::FilePath();
 376     }
 377     // This is a directory we can write to.
 378     return temp_path;
 379   }
 380
 381   // Directory doesn't exist, so create it.
 382   if (!base::CreateDirectory(temp_path)) {
 383     DLOG(WARNING) << "Couldn't create directory: " << temp_path.value();
 384     return base::FilePath();
 385   }
 386   return temp_path;
 387 }
 388
 389 void DeleteFile(const base::FilePath& path, bool recursive) {
 390   base::DeleteFile(path, recursive);
 391 }
 392
 393 base::FilePath ExtensionURLToRelativeFilePath(const GURL& url) {
 394   std::string url_path = url.path();
 395   if (url_path.empty() || url_path[0] != '/')
 396     return base::FilePath();
 397
 398   // Drop the leading slashes and convert %-encoded UTF8 to regular UTF8.
 399   std::string file_path = net::UnescapeURLComponent(url_path,
 400       net::UnescapeRule::SPACES | net::UnescapeRule::URL_SPECIAL_CHARS);
 401   size_t skip = file_path.find_first_not_of("/\\");
 402   if (skip != file_path.npos)
 403     file_path = file_path.substr(skip);
 404
 405   base::FilePath path = base::FilePath::FromUTF8Unsafe(file_path);
 406
 407   // It's still possible for someone to construct an annoying URL whose path
 408   // would still wind up not being considered relative at this point.
 409   // For example: chrome-extension://id/c:////foo.html
 410   if (path.IsAbsolute())
 411     return base::FilePath();
 412
 413   return path;
 414 }
 415
 416 base::FilePath ExtensionResourceURLToFilePath(const GURL& url,
 417                                               const base::FilePath& root) {
 418   std::string host = net::UnescapeURLComponent(url.host(),
 419       net::UnescapeRule::SPACES | net::UnescapeRule::URL_SPECIAL_CHARS);
 420   if (host.empty())
 421     return base::FilePath();
 422
 423   base::FilePath relative_path = ExtensionURLToRelativeFilePath(url);
 424   if (relative_path.empty())
 425     return base::FilePath();
 426
 427   base::FilePath path = root.AppendASCII(host).Append(relative_path);
 428   if (!base::PathExists(path))
 429     return base::FilePath();
 430   path = base::MakeAbsoluteFilePath(path);
 431   if (path.empty() || !root.IsParent(path))
 432     return base::FilePath();
 433   return path;
 434 }
 435
 436 bool ValidateExtensionIconSet(const ExtensionIconSet& icon_set,
 437                               const Extension* extension,
 438                               int error_message_id,
 439                               std::string* error) {
 440   for (ExtensionIconSet::IconMap::const_iterator iter = icon_set.map().begin();
 441        iter != icon_set.map().end();
 442        ++iter) {
 443     const base::FilePath path =
 444         extension->GetResource(iter->second).GetFilePath();
 445     if (!ValidateFilePath(path)) {
 446       *error = l10n_util::GetStringFUTF8(error_message_id,
 447                                          base::UTF8ToUTF16(iter->second));
 448       return false;
 449     }
 450   }
 451   return true;
 452 }
 453
 454 MessageBundle* LoadMessageBundle(
 455     const base::FilePath& extension_path,
 456     const std::string& default_locale,
 457     std::string* error) {
 458   error->clear();
 459   // Load locale information if available.
 460   base::FilePath locale_path = extension_path.Append(kLocaleFolder);
 461   if (!base::PathExists(locale_path))
 462     return NULL;
 463
 464   std::set<std::string> locales;
 465   if (!extension_l10n_util::GetValidLocales(locale_path, &locales, error))
 466     return NULL;
 467
 468   if (default_locale.empty() || locales.find(default_locale) == locales.end()) {
 469     *error = l10n_util::GetStringUTF8(
 470         IDS_EXTENSION_LOCALES_NO_DEFAULT_LOCALE_SPECIFIED);
 471     return NULL;
 472   }
 473
 474   MessageBundle* message_bundle =
 475       extension_l10n_util::LoadMessageCatalogs(
 476           locale_path,
 477           default_locale,
 478           extension_l10n_util::CurrentLocaleOrDefault(),
 479           locales,
 480           error);
 481
 482   return message_bundle;
 483 }
 484
 485 MessageBundle::SubstitutionMap* LoadMessageBundleSubstitutionMap(
 486     const base::FilePath& extension_path,
 487     const std::string& extension_id,
 488     const std::string& default_locale) {
 489   MessageBundle::SubstitutionMap* return_value =
 490       new MessageBundle::SubstitutionMap();
 491   if (!default_locale.empty()) {
 492     // Touch disk only if extension is localized.
 493     std::string error;
 494     scoped_ptr<MessageBundle> bundle(
 495         LoadMessageBundle(extension_path, default_locale, &error));
 496
 497     if (bundle.get())
 498       *return_value = *bundle->dictionary();
 499   }
 500
 501   // Add @@extension_id reserved message here, so it's available to
 502   // non-localized extensions too.
 503   return_value->insert(
 504       std::make_pair(MessageBundle::kExtensionIdKey, extension_id));
 505
 506   return return_value;
 507 }
 508
 509 MessageBundle::SubstitutionMap* LoadMessageBundleSubstitutionMapWithImports(
 510     const std::string& extension_id,
 511     const ExtensionSet& extension_set) {
 512   const Extension* extension = extension_set.GetByID(extension_id);
 513   MessageBundle::SubstitutionMap* return_value =
 514       new MessageBundle::SubstitutionMap();
 515
 516   // Add @@extension_id reserved message here, so it's available to
 517   // non-localized extensions too.
 518   return_value->insert(
 519       std::make_pair(MessageBundle::kExtensionIdKey, extension_id));
 520
 521   base::FilePath extension_path;
 522   std::string default_locale;
 523   if (!extension) {
 524     NOTREACHED() << "Missing extension " << extension_id;
 525     return return_value;
 526   }
 527
 528   // Touch disk only if extension is localized.
 529   default_locale = LocaleInfo::GetDefaultLocale(extension);
 530   if (default_locale.empty()) {
 531     return return_value;
 532   }
 533
 534   std::string error;
 535   scoped_ptr<MessageBundle> bundle(
 536       LoadMessageBundle(extension->path(), default_locale, &error));
 537
 538   if (bundle.get()) {
 539     for (auto iter : *bundle->dictionary()) {
 540       return_value->insert(std::make_pair(iter.first, iter.second));
 541     }
 542   }
 543
 544   auto imports = extensions::SharedModuleInfo::GetImports(extension);
 545   // Iterate through the imports in reverse.  This will allow later imported
 546   // modules to override earlier imported modules, as the list order is
 547   // maintained from the definition in manifest.json of the imports.
 548   for (auto it = imports.rbegin(); it != imports.rend(); ++it) {
 549     const extensions::Extension* imported_extension =
 550         extension_set.GetByID(it->extension_id);
 551     if (!imported_extension) {
 552       NOTREACHED() << "Missing shared module " << it->extension_id;
 553       continue;
 554     }
 555     scoped_ptr<MessageBundle> imported_bundle(
 556         LoadMessageBundle(imported_extension->path(), default_locale, &error));
 557
 558     if (imported_bundle.get()) {
 559       for (auto iter : *imported_bundle->dictionary()) {
 560         // |insert| only adds new entries, and does not replace entries in
 561         // the main extension or previously processed imports.
 562         return_value->insert(std::make_pair(iter.first, iter.second));
 563       }
 564     }
 565   }
 566
 567   return return_value;
 568 }
 569
 570 base::FilePath GetVerifiedContentsPath(const base::FilePath& extension_path) {
 571   return extension_path.Append(kMetadataFolder)
 572       .Append(kVerifiedContentsFilename);
 573 }
 574 base::FilePath GetComputedHashesPath(const base::FilePath& extension_path) {
 575   return extension_path.Append(kMetadataFolder).Append(kComputedHashesFilename);
 576 }
 577
 578 }  // namespace file_util
 579 }  // namespace extensions