components/nacl/browser/nacl_file_host.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "components/nacl/browser/nacl_file_host.h"
   6
   7 #include "base/bind.h"
   8 #include "base/files/file.h"
   9 #include "base/files/file_path.h"
  10 #include "base/files/file_util.h"
  11 #include "base/strings/utf_string_conversions.h"
  12 #include "base/threading/sequenced_worker_pool.h"
  13 #include "components/nacl/browser/nacl_browser.h"
  14 #include "components/nacl/browser/nacl_browser_delegate.h"
  15 #include "components/nacl/browser/nacl_host_message_filter.h"
  16 #include "components/nacl/common/nacl_host_messages.h"
  17 #include "content/public/browser/browser_thread.h"
  18 #include "content/public/browser/render_view_host.h"
  19 #include "content/public/browser/site_instance.h"
  20 #include "ipc/ipc_platform_file.h"
  21
  22 using content::BrowserThread;
  23
  24 namespace {
  25
  26 // Force a prefix to prevent user from opening "magic" files.
  27 const char* kExpectedFilePrefix = "pnacl_public_";
  28
  29 // Restrict PNaCl file lengths to reduce likelyhood of hitting bugs
  30 // in file name limit error-handling-code-paths, etc.
  31 const size_t kMaxFileLength = 40;
  32
  33 void NotifyRendererOfError(
  34     nacl::NaClHostMessageFilter* nacl_host_message_filter,
  35     IPC::Message* reply_msg) {
  36   reply_msg->set_reply_error();
  37   nacl_host_message_filter->Send(reply_msg);
  38 }
  39
  40 typedef void (*WriteFileInfoReply)(IPC::Message* reply_msg,
  41                                    IPC::PlatformFileForTransit file_desc,
  42                                    uint64 file_token_lo,
  43                                    uint64 file_token_hi);
  44
  45 void DoRegisterOpenedNaClExecutableFile(
  46     scoped_refptr<nacl::NaClHostMessageFilter> nacl_host_message_filter,
  47     base::File file,
  48     base::FilePath file_path,
  49     IPC::Message* reply_msg,
  50     WriteFileInfoReply write_reply_message) {
  51   // IO thread owns the NaClBrowser singleton.
  52   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
  53
  54   nacl::NaClBrowser* nacl_browser = nacl::NaClBrowser::GetInstance();
  55   uint64 file_token_lo = 0;
  56   uint64 file_token_hi = 0;
  57   nacl_browser->PutFilePath(file_path, &file_token_lo, &file_token_hi);
  58
  59   IPC::PlatformFileForTransit file_desc = IPC::TakeFileHandleForProcess(
  60       file.Pass(),
  61       nacl_host_message_filter->PeerHandle());
  62
  63   write_reply_message(reply_msg, file_desc, file_token_lo, file_token_hi);
  64   nacl_host_message_filter->Send(reply_msg);
  65 }
  66
  67 void DoOpenPnaclFile(
  68     scoped_refptr<nacl::NaClHostMessageFilter> nacl_host_message_filter,
  69     const std::string& filename,
  70     bool is_executable,
  71     IPC::Message* reply_msg) {
  72   DCHECK(BrowserThread::GetBlockingPool()->RunsTasksOnCurrentThread());
  73   base::FilePath full_filepath;
  74
  75   // PNaCl must be installed.
  76   base::FilePath pnacl_dir;
  77   if (!nacl::NaClBrowser::GetDelegate()->GetPnaclDirectory(&pnacl_dir) ||
  78       !base::PathExists(pnacl_dir)) {
  79     NotifyRendererOfError(nacl_host_message_filter.get(), reply_msg);
  80     return;
  81   }
  82
  83   // Do some validation.
  84   if (!nacl_file_host::PnaclCanOpenFile(filename, &full_filepath)) {
  85     NotifyRendererOfError(nacl_host_message_filter.get(), reply_msg);
  86     return;
  87   }
  88
  89   base::File file_to_open = nacl::OpenNaClReadExecImpl(full_filepath,
  90                                                        is_executable);
  91   if (!file_to_open.IsValid()) {
  92     NotifyRendererOfError(nacl_host_message_filter.get(), reply_msg);
  93     return;
  94   }
  95
  96   // This function is running on the blocking pool, but the path needs to be
  97   // registered in a structure owned by the IO thread.
  98   // Not all PNaCl files are executable. Only register those that are
  99   // executable in the NaCl file_path cache.
 100   if (is_executable) {
 101     BrowserThread::PostTask(
 102         BrowserThread::IO, FROM_HERE,
 103         base::Bind(&DoRegisterOpenedNaClExecutableFile,
 104                    nacl_host_message_filter,
 105                    Passed(file_to_open.Pass()), full_filepath, reply_msg,
 106                    static_cast<WriteFileInfoReply>(
 107                        NaClHostMsg_GetReadonlyPnaclFD::WriteReplyParams)));
 108   } else {
 109     IPC::PlatformFileForTransit target_desc =
 110         IPC::TakeFileHandleForProcess(file_to_open.Pass(),
 111                                       nacl_host_message_filter->PeerHandle());
 112     uint64_t dummy_file_token = 0;
 113     NaClHostMsg_GetReadonlyPnaclFD::WriteReplyParams(
 114         reply_msg, target_desc, dummy_file_token, dummy_file_token);
 115     nacl_host_message_filter->Send(reply_msg);
 116   }
 117 }
 118
 119 // Convert the file URL into a file descriptor.
 120 // This function is security sensitive.  Be sure to check with a security
 121 // person before you modify it.
 122 void DoOpenNaClExecutableOnThreadPool(
 123     scoped_refptr<nacl::NaClHostMessageFilter> nacl_host_message_filter,
 124     const GURL& file_url,
 125     IPC::Message* reply_msg) {
 126   DCHECK(BrowserThread::GetBlockingPool()->RunsTasksOnCurrentThread());
 127
 128   base::FilePath file_path;
 129   if (!nacl::NaClBrowser::GetDelegate()->MapUrlToLocalFilePath(
 130           file_url,
 131           true /* use_blocking_api */,
 132           nacl_host_message_filter->profile_directory(),
 133           &file_path)) {
 134     NotifyRendererOfError(nacl_host_message_filter.get(), reply_msg);
 135     return;
 136   }
 137
 138   base::File file = nacl::OpenNaClReadExecImpl(file_path,
 139                                                true /* is_executable */);
 140   if (file.IsValid()) {
 141     // This function is running on the blocking pool, but the path needs to be
 142     // registered in a structure owned by the IO thread.
 143     BrowserThread::PostTask(
 144         BrowserThread::IO, FROM_HERE,
 145         base::Bind(
 146             &DoRegisterOpenedNaClExecutableFile,
 147             nacl_host_message_filter,
 148             Passed(file.Pass()), file_path, reply_msg,
 149             static_cast<WriteFileInfoReply>(
 150                 NaClHostMsg_OpenNaClExecutable::WriteReplyParams)));
 151   } else {
 152     NotifyRendererOfError(nacl_host_message_filter.get(), reply_msg);
 153     return;
 154   }
 155 }
 156
 157 }  // namespace
 158
 159 namespace nacl_file_host {
 160
 161 void GetReadonlyPnaclFd(
 162     scoped_refptr<nacl::NaClHostMessageFilter> nacl_host_message_filter,
 163     const std::string& filename,
 164     bool is_executable,
 165     IPC::Message* reply_msg) {
 166   if (!BrowserThread::PostBlockingPoolTask(
 167           FROM_HERE,
 168           base::Bind(&DoOpenPnaclFile,
 169                      nacl_host_message_filter,
 170                      filename,
 171                      is_executable,
 172                      reply_msg))) {
 173     NotifyRendererOfError(nacl_host_message_filter.get(), reply_msg);
 174   }
 175 }
 176
 177 // This function is security sensitive.  Be sure to check with a security
 178 // person before you modify it.
 179 bool PnaclCanOpenFile(const std::string& filename,
 180                       base::FilePath* file_to_open) {
 181   if (filename.length() > kMaxFileLength)
 182     return false;
 183
 184   if (filename.empty())
 185     return false;
 186
 187   // Restrict character set of the file name to something really simple
 188   // (a-z, 0-9, and underscores).
 189   for (size_t i = 0; i < filename.length(); ++i) {
 190     char charAt = filename[i];
 191     if (charAt < 'a' || charAt > 'z')
 192       if (charAt < '0' || charAt > '9')
 193         if (charAt != '_')
 194           return false;
 195   }
 196
 197   // PNaCl must be installed.
 198   base::FilePath pnacl_dir;
 199   if (!nacl::NaClBrowser::GetDelegate()->GetPnaclDirectory(&pnacl_dir) ||
 200       pnacl_dir.empty())
 201     return false;
 202
 203   // Prepend the prefix to restrict files to a whitelisted set.
 204   base::FilePath full_path = pnacl_dir.AppendASCII(
 205       std::string(kExpectedFilePrefix) + filename);
 206   *file_to_open = full_path;
 207   return true;
 208 }
 209
 210 void OpenNaClExecutable(
 211     scoped_refptr<nacl::NaClHostMessageFilter> nacl_host_message_filter,
 212     int render_view_id,
 213     const GURL& file_url,
 214     IPC::Message* reply_msg) {
 215   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
 216     BrowserThread::PostTask(
 217         BrowserThread::UI, FROM_HERE,
 218         base::Bind(
 219             &OpenNaClExecutable,
 220             nacl_host_message_filter,
 221             render_view_id, file_url, reply_msg));
 222     return;
 223   }
 224
 225   // Make sure render_view_id is valid and that the URL is a part of the
 226   // render view's site. Without these checks, apps could probe the extension
 227   // directory or run NaCl code from other extensions.
 228   content::RenderViewHost* rvh = content::RenderViewHost::FromID(
 229       nacl_host_message_filter->render_process_id(), render_view_id);
 230   if (!rvh) {
 231     nacl_host_message_filter->BadMessageReceived();  // Kill the renderer.
 232     return;
 233   }
 234   content::SiteInstance* site_instance = rvh->GetSiteInstance();
 235   if (!content::SiteInstance::IsSameWebSite(site_instance->GetBrowserContext(),
 236                                             site_instance->GetSiteURL(),
 237                                             file_url)) {
 238     NotifyRendererOfError(nacl_host_message_filter.get(), reply_msg);
 239     return;
 240   }
 241
 242   // The URL is part of the current app. Now query the extension system for the
 243   // file path and convert that to a file descriptor. This should be done on a
 244   // blocking pool thread.
 245   if (!BrowserThread::PostBlockingPoolTask(
 246       FROM_HERE,
 247       base::Bind(
 248           &DoOpenNaClExecutableOnThreadPool,
 249           nacl_host_message_filter,
 250           file_url, reply_msg))) {
 251     NotifyRendererOfError(nacl_host_message_filter.get(), reply_msg);
 252   }
 253 }
 254
 255 }  // namespace nacl_file_host