net/base/filename_util_internal.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/base/filename_util.h"
   6
   7 #include "base/files/file_path.h"
   8 #include "base/files/file_util.h"
   9 #include "base/strings/string_util.h"
  10 #include "base/strings/sys_string_conversions.h"
  11 #include "base/strings/utf_string_conversions.h"
  12 #include "base/threading/thread_restrictions.h"
  13 #include "net/base/escape.h"
  14 #include "net/base/filename_util_internal.h"
  15 #include "net/base/mime_util.h"
  16 #include "net/base/net_string_util.h"
  17 #include "net/http/http_content_disposition.h"
  18 #include "url/gurl.h"
  19
  20 namespace net {
  21
  22 void SanitizeGeneratedFileName(base::FilePath::StringType* filename,
  23                                bool replace_trailing) {
  24   const base::FilePath::CharType kReplace[] = FILE_PATH_LITERAL("-");
  25   if (filename->empty())
  26     return;
  27   if (replace_trailing) {
  28     // Handle CreateFile() stripping trailing dots and spaces on filenames
  29     // http://support.microsoft.com/kb/115827
  30     size_t length = filename->size();
  31     size_t pos = filename->find_last_not_of(FILE_PATH_LITERAL(" ."));
  32     filename->resize((pos == std::string::npos) ? 0 : (pos + 1));
  33     base::TrimWhitespace(*filename, base::TRIM_TRAILING, filename);
  34     if (filename->empty())
  35       return;
  36     size_t trimmed = length - filename->size();
  37     if (trimmed)
  38       filename->insert(filename->end(), trimmed, kReplace[0]);
  39   }
  40   base::TrimString(*filename, FILE_PATH_LITERAL("."), filename);
  41   if (filename->empty())
  42     return;
  43   // Replace any path information by changing path separators.
  44   base::ReplaceSubstringsAfterOffset(
  45       filename, 0, FILE_PATH_LITERAL("/"), kReplace);
  46   base::ReplaceSubstringsAfterOffset(
  47       filename, 0, FILE_PATH_LITERAL("\\"), kReplace);
  48 }
  49
  50 // Returns the filename determined from the last component of the path portion
  51 // of the URL.  Returns an empty string if the URL doesn't have a path or is
  52 // invalid. If the generated filename is not reliable,
  53 // |should_overwrite_extension| will be set to true, in which case a better
  54 // extension should be determined based on the content type.
  55 std::string GetFileNameFromURL(const GURL& url,
  56                                const std::string& referrer_charset,
  57                                bool* should_overwrite_extension) {
  58   // about: and data: URLs don't have file names, but esp. data: URLs may
  59   // contain parts that look like ones (i.e., contain a slash).  Therefore we
  60   // don't attempt to divine a file name out of them.
  61   if (!url.is_valid() || url.SchemeIs("about") || url.SchemeIs("data"))
  62     return std::string();
  63
  64   const std::string unescaped_url_filename = UnescapeURLComponent(
  65       url.ExtractFileName(),
  66       UnescapeRule::SPACES | UnescapeRule::URL_SPECIAL_CHARS);
  67
  68   // The URL's path should be escaped UTF-8, but may not be.
  69   std::string decoded_filename = unescaped_url_filename;
  70   if (!base::IsStringUTF8(decoded_filename)) {
  71     // TODO(jshin): this is probably not robust enough. To be sure, we need
  72     // encoding detection.
  73     base::string16 utf16_output;
  74     if (!referrer_charset.empty() &&
  75         ConvertToUTF16(unescaped_url_filename, referrer_charset.c_str(),
  76                        &utf16_output)) {
  77       decoded_filename = base::UTF16ToUTF8(utf16_output);
  78     } else {
  79       decoded_filename =
  80           base::WideToUTF8(base::SysNativeMBToWide(unescaped_url_filename));
  81     }
  82   }
  83   // If the URL contains a (possibly empty) query, assume it is a generator, and
  84   // allow the determined extension to be overwritten.
  85   *should_overwrite_extension = !decoded_filename.empty() && url.has_query();
  86
  87   return decoded_filename;
  88 }
  89
  90 // Returns whether the specified extension is automatically integrated into the
  91 // windows shell.
  92 bool IsShellIntegratedExtension(const base::FilePath::StringType& extension) {
  93   base::FilePath::StringType extension_lower =
  94       base::StringToLowerASCII(extension);
  95
  96   // http://msdn.microsoft.com/en-us/library/ms811694.aspx
  97   // Right-clicking on shortcuts can be magical.
  98   if ((extension_lower == FILE_PATH_LITERAL("local")) ||
  99       (extension_lower == FILE_PATH_LITERAL("lnk")))
 100     return true;
 101
 102   // http://www.juniper.net/security/auto/vulnerabilities/vuln2612.html
 103   // Files become magical if they end in a CLSID, so block such extensions.
 104   if (!extension_lower.empty() &&
 105       (extension_lower[0] == FILE_PATH_LITERAL('{')) &&
 106       (extension_lower[extension_lower.length() - 1] == FILE_PATH_LITERAL('}')))
 107     return true;
 108   return false;
 109 }
 110
 111 // Examines the current extension in |file_name| and modifies it if necessary in
 112 // order to ensure the filename is safe.  If |file_name| doesn't contain an
 113 // extension or if |ignore_extension| is true, then a new extension will be
 114 // constructed based on the |mime_type|.
 115 //
 116 // We're addressing two things here:
 117 //
 118 // 1) Usability.  If there is no reliable file extension, we want to guess a
 119 //    reasonable file extension based on the content type.
 120 //
 121 // 2) Shell integration.  Some file extensions automatically integrate with the
 122 //    shell.  We block these extensions to prevent a malicious web site from
 123 //    integrating with the user's shell.
 124 void EnsureSafeExtension(const std::string& mime_type,
 125                          bool ignore_extension,
 126                          base::FilePath* file_name) {
 127   // See if our file name already contains an extension.
 128   base::FilePath::StringType extension = file_name->Extension();
 129   if (!extension.empty())
 130     extension.erase(extension.begin());  // Erase preceding '.'.
 131
 132   if ((ignore_extension || extension.empty()) && !mime_type.empty()) {
 133     base::FilePath::StringType preferred_mime_extension;
 134     std::vector<base::FilePath::StringType> all_mime_extensions;
 135     GetPreferredExtensionForMimeType(mime_type, &preferred_mime_extension);
 136     GetExtensionsForMimeType(mime_type, &all_mime_extensions);
 137     // If the existing extension is in the list of valid extensions for the
 138     // given type, use it. This avoids doing things like pointlessly renaming
 139     // "foo.jpg" to "foo.jpeg".
 140     if (std::find(all_mime_extensions.begin(),
 141                   all_mime_extensions.end(),
 142                   extension) != all_mime_extensions.end()) {
 143       // leave |extension| alone
 144     } else if (!preferred_mime_extension.empty()) {
 145       extension = preferred_mime_extension;
 146     }
 147   }
 148
 149 #if defined(OS_WIN)
 150   static const base::FilePath::CharType default_extension[] =
 151       FILE_PATH_LITERAL("download");
 152
 153   // Rename shell-integrated extensions.
 154   // TODO(asanka): Consider stripping out the bad extension and replacing it
 155   // with the preferred extension for the MIME type if one is available.
 156   if (IsShellIntegratedExtension(extension))
 157     extension.assign(default_extension);
 158 #endif
 159
 160   *file_name = file_name->ReplaceExtension(extension);
 161 }
 162
 163 bool FilePathToString16(const base::FilePath& path, base::string16* converted) {
 164 #if defined(OS_WIN)
 165   *converted = path.value();
 166   return true;
 167 #elif defined(OS_POSIX)
 168   std::string component8 = path.AsUTF8Unsafe();
 169   return !component8.empty() &&
 170          base::UTF8ToUTF16(component8.c_str(), component8.size(), converted);
 171 #endif
 172 }
 173
 174 base::string16 GetSuggestedFilenameImpl(
 175     const GURL& url,
 176     const std::string& content_disposition,
 177     const std::string& referrer_charset,
 178     const std::string& suggested_name,
 179     const std::string& mime_type,
 180     const std::string& default_name,
 181     ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
 182   // TODO: this function to be updated to match the httpbis recommendations.
 183   // Talk to abarth for the latest news.
 184
 185   // We don't translate this fallback string, "download". If localization is
 186   // needed, the caller should provide localized fallback in |default_name|.
 187   static const base::FilePath::CharType kFinalFallbackName[] =
 188       FILE_PATH_LITERAL("download");
 189   std::string filename;  // In UTF-8
 190   bool overwrite_extension = false;
 191   bool is_name_from_content_disposition = false;
 192   // Try to extract a filename from content-disposition first.
 193   if (!content_disposition.empty()) {
 194     HttpContentDisposition header(content_disposition, referrer_charset);
 195     filename = header.filename();
 196     if (!filename.empty())
 197       is_name_from_content_disposition = true;
 198   }
 199
 200   // Then try to use the suggested name.
 201   if (filename.empty() && !suggested_name.empty())
 202     filename = suggested_name;
 203
 204   // Now try extracting the filename from the URL.  GetFileNameFromURL() only
 205   // looks at the last component of the URL and doesn't return the hostname as a
 206   // failover.
 207   if (filename.empty())
 208     filename = GetFileNameFromURL(url, referrer_charset, &overwrite_extension);
 209
 210   // Finally try the URL hostname, but only if there's no default specified in
 211   // |default_name|.  Some schemes (e.g.: file:, about:, data:) do not have a
 212   // host name.
 213   if (filename.empty() && default_name.empty() && url.is_valid() &&
 214       !url.host().empty()) {
 215     // TODO(jungshik) : Decode a 'punycoded' IDN hostname. (bug 1264451)
 216     filename = url.host();
 217   }
 218
 219   bool replace_trailing = false;
 220   base::FilePath::StringType result_str, default_name_str;
 221 #if defined(OS_WIN)
 222   replace_trailing = true;
 223   result_str = base::UTF8ToUTF16(filename);
 224   default_name_str = base::UTF8ToUTF16(default_name);
 225 #else
 226   result_str = filename;
 227   default_name_str = default_name;
 228 #endif
 229   SanitizeGeneratedFileName(&result_str, replace_trailing);
 230   if (result_str.find_last_not_of(FILE_PATH_LITERAL("-_")) ==
 231       base::FilePath::StringType::npos) {
 232     result_str = !default_name_str.empty()
 233                      ? default_name_str
 234                      : base::FilePath::StringType(kFinalFallbackName);
 235     overwrite_extension = false;
 236   }
 237   replace_illegal_characters_callback.Run(&result_str, '-');
 238   base::FilePath result(result_str);
 239   // extension should not appended to filename derived from
 240   // content-disposition, if it does not have one.
 241   // Hence mimetype and overwrite_extension values are not used.
 242   if (is_name_from_content_disposition)
 243     GenerateSafeFileName("", false, &result);
 244   else
 245     GenerateSafeFileName(mime_type, overwrite_extension, &result);
 246
 247   base::string16 result16;
 248   if (!FilePathToString16(result, &result16)) {
 249     result = base::FilePath(default_name_str);
 250     if (!FilePathToString16(result, &result16)) {
 251       result = base::FilePath(kFinalFallbackName);
 252       FilePathToString16(result, &result16);
 253     }
 254   }
 255   return result16;
 256 }
 257
 258 base::FilePath GenerateFileNameImpl(
 259     const GURL& url,
 260     const std::string& content_disposition,
 261     const std::string& referrer_charset,
 262     const std::string& suggested_name,
 263     const std::string& mime_type,
 264     const std::string& default_file_name,
 265     ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
 266   base::string16 file_name =
 267       GetSuggestedFilenameImpl(url,
 268                                content_disposition,
 269                                referrer_charset,
 270                                suggested_name,
 271                                mime_type,
 272                                default_file_name,
 273                                replace_illegal_characters_callback);
 274
 275 #if defined(OS_WIN)
 276   base::FilePath generated_name(file_name);
 277 #else
 278   base::FilePath generated_name(
 279       base::SysWideToNativeMB(base::UTF16ToWide(file_name)));
 280 #endif
 281
 282   DCHECK(!generated_name.empty());
 283
 284   return generated_name;
 285 }
 286
 287 }  // namespace net