1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "components/nacl/browser/nacl_file_host.h"
8 #include "base/files/file.h"
9 #include "base/files/file_path.h"
10 #include "base/files/file_util.h"
11 #include "base/strings/utf_string_conversions.h"
12 #include "base/threading/sequenced_worker_pool.h"
13 #include "components/nacl/browser/nacl_browser.h"
14 #include "components/nacl/browser/nacl_browser_delegate.h"
15 #include "components/nacl/browser/nacl_host_message_filter.h"
16 #include "components/nacl/common/nacl_host_messages.h"
17 #include "content/public/browser/browser_thread.h"
18 #include "content/public/browser/render_view_host.h"
19 #include "content/public/browser/site_instance.h"
20 #include "ipc/ipc_platform_file.h"
22 using content::BrowserThread
;
26 // Force a prefix to prevent user from opening "magic" files.
27 const char* kExpectedFilePrefix
= "pnacl_public_";
29 // Restrict PNaCl file lengths to reduce likelyhood of hitting bugs
30 // in file name limit error-handling-code-paths, etc.
31 const size_t kMaxFileLength
= 40;
33 void NotifyRendererOfError(
34 nacl::NaClHostMessageFilter
* nacl_host_message_filter
,
35 IPC::Message
* reply_msg
) {
36 reply_msg
->set_reply_error();
37 nacl_host_message_filter
->Send(reply_msg
);
40 typedef void (*WriteFileInfoReply
)(IPC::Message
* reply_msg
,
41 IPC::PlatformFileForTransit file_desc
,
43 uint64 file_token_hi
);
45 void DoRegisterOpenedNaClExecutableFile(
46 scoped_refptr
<nacl::NaClHostMessageFilter
> nacl_host_message_filter
,
48 base::FilePath file_path
,
49 IPC::Message
* reply_msg
,
50 WriteFileInfoReply write_reply_message
) {
51 // IO thread owns the NaClBrowser singleton.
52 DCHECK_CURRENTLY_ON(BrowserThread::IO
);
54 nacl::NaClBrowser
* nacl_browser
= nacl::NaClBrowser::GetInstance();
55 uint64 file_token_lo
= 0;
56 uint64 file_token_hi
= 0;
57 nacl_browser
->PutFilePath(file_path
, &file_token_lo
, &file_token_hi
);
59 IPC::PlatformFileForTransit file_desc
= IPC::TakeFileHandleForProcess(
61 nacl_host_message_filter
->PeerHandle());
63 write_reply_message(reply_msg
, file_desc
, file_token_lo
, file_token_hi
);
64 nacl_host_message_filter
->Send(reply_msg
);
68 scoped_refptr
<nacl::NaClHostMessageFilter
> nacl_host_message_filter
,
69 const std::string
& filename
,
71 IPC::Message
* reply_msg
) {
72 DCHECK(BrowserThread::GetBlockingPool()->RunsTasksOnCurrentThread());
73 base::FilePath full_filepath
;
75 // PNaCl must be installed.
76 base::FilePath pnacl_dir
;
77 if (!nacl::NaClBrowser::GetDelegate()->GetPnaclDirectory(&pnacl_dir
) ||
78 !base::PathExists(pnacl_dir
)) {
79 NotifyRendererOfError(nacl_host_message_filter
.get(), reply_msg
);
83 // Do some validation.
84 if (!nacl_file_host::PnaclCanOpenFile(filename
, &full_filepath
)) {
85 NotifyRendererOfError(nacl_host_message_filter
.get(), reply_msg
);
89 base::File file_to_open
= nacl::OpenNaClReadExecImpl(full_filepath
,
91 if (!file_to_open
.IsValid()) {
92 NotifyRendererOfError(nacl_host_message_filter
.get(), reply_msg
);
96 // This function is running on the blocking pool, but the path needs to be
97 // registered in a structure owned by the IO thread.
98 // Not all PNaCl files are executable. Only register those that are
99 // executable in the NaCl file_path cache.
101 BrowserThread::PostTask(
102 BrowserThread::IO
, FROM_HERE
,
103 base::Bind(&DoRegisterOpenedNaClExecutableFile
,
104 nacl_host_message_filter
,
105 Passed(file_to_open
.Pass()), full_filepath
, reply_msg
,
106 static_cast<WriteFileInfoReply
>(
107 NaClHostMsg_GetReadonlyPnaclFD::WriteReplyParams
)));
109 IPC::PlatformFileForTransit target_desc
=
110 IPC::TakeFileHandleForProcess(file_to_open
.Pass(),
111 nacl_host_message_filter
->PeerHandle());
112 uint64_t dummy_file_token
= 0;
113 NaClHostMsg_GetReadonlyPnaclFD::WriteReplyParams(
114 reply_msg
, target_desc
, dummy_file_token
, dummy_file_token
);
115 nacl_host_message_filter
->Send(reply_msg
);
119 // Convert the file URL into a file descriptor.
120 // This function is security sensitive. Be sure to check with a security
121 // person before you modify it.
122 void DoOpenNaClExecutableOnThreadPool(
123 scoped_refptr
<nacl::NaClHostMessageFilter
> nacl_host_message_filter
,
124 const GURL
& file_url
,
125 bool enable_validation_caching
,
126 IPC::Message
* reply_msg
) {
127 DCHECK(BrowserThread::GetBlockingPool()->RunsTasksOnCurrentThread());
129 base::FilePath file_path
;
130 if (!nacl::NaClBrowser::GetDelegate()->MapUrlToLocalFilePath(
132 true /* use_blocking_api */,
133 nacl_host_message_filter
->profile_directory(),
135 NotifyRendererOfError(nacl_host_message_filter
.get(), reply_msg
);
139 base::File file
= nacl::OpenNaClReadExecImpl(file_path
,
140 true /* is_executable */);
141 if (file
.IsValid()) {
142 // Opening a NaCl executable works with or without validation caching.
143 // Validation caching requires that the file descriptor is registered now
144 // for later use, which will save time.
145 // When validation caching isn't used (e.g. Non-SFI mode), there is no
146 // reason to do that unnecessary registration.
147 if (enable_validation_caching
) {
148 // This function is running on the blocking pool, but the path needs to be
149 // registered in a structure owned by the IO thread.
150 BrowserThread::PostTask(
151 BrowserThread::IO
, FROM_HERE
,
153 &DoRegisterOpenedNaClExecutableFile
,
154 nacl_host_message_filter
,
155 Passed(file
.Pass()), file_path
, reply_msg
,
156 static_cast<WriteFileInfoReply
>(
157 NaClHostMsg_OpenNaClExecutable::WriteReplyParams
)));
159 IPC::PlatformFileForTransit file_desc
=
160 IPC::TakeFileHandleForProcess(file
.Pass(),
161 nacl_host_message_filter
->PeerHandle());
162 uint64_t dummy_file_token
= 0;
163 NaClHostMsg_OpenNaClExecutable::WriteReplyParams(
164 reply_msg
, file_desc
, dummy_file_token
, dummy_file_token
);
165 nacl_host_message_filter
->Send(reply_msg
);
168 NotifyRendererOfError(nacl_host_message_filter
.get(), reply_msg
);
175 namespace nacl_file_host
{
177 void GetReadonlyPnaclFd(
178 scoped_refptr
<nacl::NaClHostMessageFilter
> nacl_host_message_filter
,
179 const std::string
& filename
,
181 IPC::Message
* reply_msg
) {
182 if (!BrowserThread::PostBlockingPoolTask(
184 base::Bind(&DoOpenPnaclFile
,
185 nacl_host_message_filter
,
189 NotifyRendererOfError(nacl_host_message_filter
.get(), reply_msg
);
193 // This function is security sensitive. Be sure to check with a security
194 // person before you modify it.
195 bool PnaclCanOpenFile(const std::string
& filename
,
196 base::FilePath
* file_to_open
) {
197 if (filename
.length() > kMaxFileLength
)
200 if (filename
.empty())
203 // Restrict character set of the file name to something really simple
204 // (a-z, 0-9, and underscores).
205 for (size_t i
= 0; i
< filename
.length(); ++i
) {
206 char charAt
= filename
[i
];
207 if (charAt
< 'a' || charAt
> 'z')
208 if (charAt
< '0' || charAt
> '9')
213 // PNaCl must be installed.
214 base::FilePath pnacl_dir
;
215 if (!nacl::NaClBrowser::GetDelegate()->GetPnaclDirectory(&pnacl_dir
) ||
219 // Prepend the prefix to restrict files to a whitelisted set.
220 base::FilePath full_path
= pnacl_dir
.AppendASCII(
221 std::string(kExpectedFilePrefix
) + filename
);
222 *file_to_open
= full_path
;
226 void OpenNaClExecutable(
227 scoped_refptr
<nacl::NaClHostMessageFilter
> nacl_host_message_filter
,
229 const GURL
& file_url
,
230 bool enable_validation_caching
,
231 IPC::Message
* reply_msg
) {
232 if (!BrowserThread::CurrentlyOn(BrowserThread::UI
)) {
233 BrowserThread::PostTask(
234 BrowserThread::UI
, FROM_HERE
,
237 nacl_host_message_filter
,
240 enable_validation_caching
,
245 // Make sure render_view_id is valid and that the URL is a part of the
246 // render view's site. Without these checks, apps could probe the extension
247 // directory or run NaCl code from other extensions.
248 content::RenderViewHost
* rvh
= content::RenderViewHost::FromID(
249 nacl_host_message_filter
->render_process_id(), render_view_id
);
251 nacl_host_message_filter
->BadMessageReceived(); // Kill the renderer.
254 content::SiteInstance
* site_instance
= rvh
->GetSiteInstance();
255 if (!content::SiteInstance::IsSameWebSite(site_instance
->GetBrowserContext(),
256 site_instance
->GetSiteURL(),
258 NotifyRendererOfError(nacl_host_message_filter
.get(), reply_msg
);
262 // The URL is part of the current app. Now query the extension system for the
263 // file path and convert that to a file descriptor. This should be done on a
264 // blocking pool thread.
265 if (!BrowserThread::PostBlockingPoolTask(
268 &DoOpenNaClExecutableOnThreadPool
,
269 nacl_host_message_filter
,
271 enable_validation_caching
,
273 NotifyRendererOfError(nacl_host_message_filter
.get(), reply_msg
);
277 } // namespace nacl_file_host