content/browser/safe_util_win.cc

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <shlobj.h>
   6 #include <shobjidl.h>
   7
   8 #include "content/browser/safe_util_win.h"
   9
  10 #include "base/files/file_path.h"
  11 #include "base/logging.h"
  12 #include "base/strings/string_util.h"
  13 #include "base/strings/utf_string_conversions.h"
  14 #include "base/win/scoped_comptr.h"
  15 #include "ui/base/win/shell.h"
  16 #include "url/gurl.h"
  17
  18 namespace content {
  19 namespace {
  20
  21 // Sets the Zone Identifier on the file to "Internet" (3). Returns true if the
  22 // function succeeds, false otherwise. A failure is expected on system where
  23 // the Zone Identifier is not supported, like a machine with a FAT32 filesystem.
  24 // This function does not invoke Windows Attachment Execution Services.
  25 //
  26 // |full_path| is the path to the downloaded file.
  27 bool SetInternetZoneIdentifierDirectly(const base::FilePath& full_path) {
  28   const DWORD kShare = FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE;
  29   std::wstring path = full_path.value() + L":Zone.Identifier";
  30   HANDLE file = CreateFile(path.c_str(), GENERIC_WRITE, kShare, NULL,
  31                            OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
  32   if (INVALID_HANDLE_VALUE == file)
  33     return false;
  34
  35   static const char kIdentifier[] = "[ZoneTransfer]\r\nZoneId=3\r\n";
  36   // Don't include trailing null in data written.
  37   static const DWORD kIdentifierSize = arraysize(kIdentifier) - 1;
  38   DWORD written = 0;
  39   BOOL result = WriteFile(file, kIdentifier, kIdentifierSize, &written, NULL);
  40   BOOL flush_result = FlushFileBuffers(file);
  41   CloseHandle(file);
  42
  43   if (!result || !flush_result || written != kIdentifierSize) {
  44     NOTREACHED();
  45     return false;
  46   }
  47
  48   return true;
  49 }
  50
  51 }  // namespace
  52
  53 HRESULT AVScanFile(const base::FilePath& full_path,
  54                    const std::string& source_url,
  55                    const GUID& client_guid) {
  56   base::win::ScopedComPtr<IAttachmentExecute> attachment_services;
  57   HRESULT hr = attachment_services.CreateInstance(CLSID_AttachmentServices);
  58
  59   if (FAILED(hr)) {
  60     // The thread must have COM initialized.
  61     DCHECK_NE(CO_E_NOTINITIALIZED, hr);
  62
  63     // We don't have Attachment Execution Services, it must be a pre-XP.SP2
  64     // Windows installation, or the thread does not have COM initialized. Try to
  65     // set the zone information directly. Failure is not considered an error.
  66     SetInternetZoneIdentifierDirectly(full_path);
  67     return hr;
  68   }
  69
  70   if (!IsEqualGUID(client_guid, GUID_NULL)) {
  71     hr = attachment_services->SetClientGuid(client_guid);
  72     if (FAILED(hr))
  73       return hr;
  74   }
  75
  76   hr = attachment_services->SetLocalPath(full_path.value().c_str());
  77   if (FAILED(hr))
  78     return hr;
  79
  80   // Note: SetSource looks like it needs to be called, even if empty.
  81   // Docs say it is optional, but it appears not calling it at all sets
  82   // a zone that is too restrictive.
  83   hr = attachment_services->SetSource(base::UTF8ToWide(source_url).c_str());
  84   if (FAILED(hr))
  85     return hr;
  86
  87   // A failure in the Save() call below could result in the downloaded file
  88   // being deleted.
  89   return attachment_services->Save();
  90 }
  91
  92 }  // namespace content