chrome/browser/extensions/sandboxed_unpacker.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/extensions/sandboxed_unpacker.h"
   6
   7 #include <set>
   8
   9 #include "base/base64.h"
  10 #include "base/bind.h"
  11 #include "base/command_line.h"
  12 #include "base/file_util.h"
  13 #include "base/files/file_util_proxy.h"
  14 #include "base/json/json_string_value_serializer.h"
  15 #include "base/memory/scoped_handle.h"
  16 #include "base/message_loop/message_loop.h"
  17 #include "base/metrics/histogram.h"
  18 #include "base/numerics/safe_conversions.h"
  19 #include "base/path_service.h"
  20 #include "base/sequenced_task_runner.h"
  21 #include "base/strings/utf_string_conversions.h"
  22 #include "base/threading/sequenced_worker_pool.h"
  23 #include "chrome/browser/extensions/extension_service.h"
  24 #include "chrome/common/chrome_paths.h"
  25 #include "chrome/common/chrome_switches.h"
  26 #include "chrome/common/chrome_utility_messages.h"
  27 #include "chrome/common/extensions/extension_file_util.h"
  28 #include "content/public/browser/browser_thread.h"
  29 #include "content/public/browser/utility_process_host.h"
  30 #include "content/public/common/common_param_traits.h"
  31 #include "crypto/signature_verifier.h"
  32 #include "extensions/common/constants.h"
  33 #include "extensions/common/crx_file.h"
  34 #include "extensions/common/extension.h"
  35 #include "extensions/common/extension_l10n_util.h"
  36 #include "extensions/common/file_util.h"
  37 #include "extensions/common/id_util.h"
  38 #include "extensions/common/manifest_constants.h"
  39 #include "extensions/common/manifest_handlers/icons_handler.h"
  40 #include "grit/generated_resources.h"
  41 #include "third_party/skia/include/core/SkBitmap.h"
  42 #include "ui/base/l10n/l10n_util.h"
  43 #include "ui/gfx/codec/png_codec.h"
  44
  45 using base::ASCIIToUTF16;
  46 using content::BrowserThread;
  47 using content::UtilityProcessHost;
  48
  49 // The following macro makes histograms that record the length of paths
  50 // in this file much easier to read.
  51 // Windows has a short max path length. If the path length to a
  52 // file being unpacked from a CRX exceeds the max length, we might
  53 // fail to install. To see if this is happening, see how long the
  54 // path to the temp unpack directory is. See crbug.com/69693 .
  55 #define PATH_LENGTH_HISTOGRAM(name, path) \
  56     UMA_HISTOGRAM_CUSTOM_COUNTS(name, path.value().length(), 0, 500, 100)
  57
  58 // Record a rate (kB per second) at which extensions are unpacked.
  59 // Range from 1kB/s to 100mB/s.
  60 #define UNPACK_RATE_HISTOGRAM(name, rate) \
  61     UMA_HISTOGRAM_CUSTOM_COUNTS(name, rate, 1, 100000, 100);
  62
  63 namespace extensions {
  64 namespace {
  65
  66 void RecordSuccessfulUnpackTimeHistograms(
  67     const base::FilePath& crx_path, const base::TimeDelta unpack_time) {
  68
  69   const int64 kBytesPerKb = 1024;
  70   const int64 kBytesPerMb = 1024 * 1024;
  71
  72   UMA_HISTOGRAM_TIMES("Extensions.SandboxUnpackSuccessTime", unpack_time);
  73
  74   // To get a sense of how CRX size impacts unpack time, record unpack
  75   // time for several increments of CRX size.
  76   int64 crx_file_size;
  77   if (!base::GetFileSize(crx_path, &crx_file_size)) {
  78     UMA_HISTOGRAM_COUNTS("Extensions.SandboxUnpackSuccessCantGetCrxSize", 1);
  79     return;
  80   }
  81
  82   // Cast is safe as long as the number of bytes in the CRX is less than
  83   // 2^31 * 2^10.
  84   int crx_file_size_kb = static_cast<int>(crx_file_size / kBytesPerKb);
  85   UMA_HISTOGRAM_COUNTS(
  86       "Extensions.SandboxUnpackSuccessCrxSize", crx_file_size_kb);
  87
  88   // We have time in seconds and file size in bytes.  We want the rate bytes are
  89   // unpacked in kB/s.
  90   double file_size_kb =
  91       static_cast<double>(crx_file_size) / static_cast<double>(kBytesPerKb);
  92   int unpack_rate_kb_per_s =
  93       static_cast<int>(file_size_kb / unpack_time.InSecondsF());
  94   UNPACK_RATE_HISTOGRAM("Extensions.SandboxUnpackRate", unpack_rate_kb_per_s);
  95
  96   if (crx_file_size < 50.0 * kBytesPerKb) {
  97     UNPACK_RATE_HISTOGRAM(
  98         "Extensions.SandboxUnpackRateUnder50kB", unpack_rate_kb_per_s);
  99
 100   } else if (crx_file_size < 1 * kBytesPerMb) {
 101     UNPACK_RATE_HISTOGRAM(
 102         "Extensions.SandboxUnpackRate50kBTo1mB", unpack_rate_kb_per_s);
 103
 104   } else if (crx_file_size < 2 * kBytesPerMb) {
 105     UNPACK_RATE_HISTOGRAM(
 106         "Extensions.SandboxUnpackRate1To2mB", unpack_rate_kb_per_s);
 107
 108   } else if (crx_file_size < 5 * kBytesPerMb) {
 109     UNPACK_RATE_HISTOGRAM(
 110         "Extensions.SandboxUnpackRate2To5mB", unpack_rate_kb_per_s);
 111
 112   } else if (crx_file_size < 10 * kBytesPerMb) {
 113     UNPACK_RATE_HISTOGRAM(
 114         "Extensions.SandboxUnpackRate5To10mB", unpack_rate_kb_per_s);
 115
 116   } else {
 117     UNPACK_RATE_HISTOGRAM(
 118         "Extensions.SandboxUnpackRateOver10mB", unpack_rate_kb_per_s);
 119   }
 120 }
 121
 122 // Work horse for FindWritableTempLocation. Creates a temp file in the folder
 123 // and uses NormalizeFilePath to check if the path is junction free.
 124 bool VerifyJunctionFreeLocation(base::FilePath* temp_dir) {
 125   if (temp_dir->empty())
 126     return false;
 127
 128   base::FilePath temp_file;
 129   if (!base::CreateTemporaryFileInDir(*temp_dir, &temp_file)) {
 130     LOG(ERROR) << temp_dir->value() << " is not writable";
 131     return false;
 132   }
 133   // NormalizeFilePath requires a non-empty file, so write some data.
 134   // If you change the exit points of this function please make sure all
 135   // exit points delete this temp file!
 136   if (base::WriteFile(temp_file, ".", 1) != 1)
 137     return false;
 138
 139   base::FilePath normalized_temp_file;
 140   bool normalized = base::NormalizeFilePath(temp_file, &normalized_temp_file);
 141   if (!normalized) {
 142     // If |temp_file| contains a link, the sandbox will block al file system
 143     // operations, and the install will fail.
 144     LOG(ERROR) << temp_dir->value() << " seem to be on remote drive.";
 145   } else {
 146     *temp_dir = normalized_temp_file.DirName();
 147   }
 148   // Clean up the temp file.
 149   base::DeleteFile(temp_file, false);
 150
 151   return normalized;
 152 }
 153
 154 // This function tries to find a location for unpacking the extension archive
 155 // that is writable and does not lie on a shared drive so that the sandboxed
 156 // unpacking process can write there. If no such location exists we can not
 157 // proceed and should fail.
 158 // The result will be written to |temp_dir|. The function will write to this
 159 // parameter even if it returns false.
 160 bool FindWritableTempLocation(const base::FilePath& extensions_dir,
 161                               base::FilePath* temp_dir) {
 162 // On ChromeOS, we will only attempt to unpack extension in cryptohome (profile)
 163 // directory to provide additional security/privacy and speed up the rest of
 164 // the extension install process.
 165 #if !defined(OS_CHROMEOS)
 166   PathService::Get(base::DIR_TEMP, temp_dir);
 167   if (VerifyJunctionFreeLocation(temp_dir))
 168     return true;
 169 #endif
 170
 171   *temp_dir = file_util::GetInstallTempDir(extensions_dir);
 172   if (VerifyJunctionFreeLocation(temp_dir))
 173     return true;
 174   // Neither paths is link free chances are good installation will fail.
 175   LOG(ERROR) << "Both the %TEMP% folder and the profile seem to be on "
 176              << "remote drives or read-only. Installation can not complete!";
 177   return false;
 178 }
 179
 180 // Read the decoded images back from the file we saved them to.
 181 // |extension_path| is the path to the extension we unpacked that wrote the
 182 // data. Returns true on success.
 183 bool ReadImagesFromFile(const base::FilePath& extension_path,
 184                         DecodedImages* images) {
 185   base::FilePath path =
 186       extension_path.AppendASCII(kDecodedImagesFilename);
 187   std::string file_str;
 188   if (!base::ReadFileToString(path, &file_str))
 189     return false;
 190
 191   IPC::Message pickle(file_str.data(), file_str.size());
 192   PickleIterator iter(pickle);
 193   return IPC::ReadParam(&pickle, &iter, images);
 194 }
 195
 196 // Read the decoded message catalogs back from the file we saved them to.
 197 // |extension_path| is the path to the extension we unpacked that wrote the
 198 // data. Returns true on success.
 199 bool ReadMessageCatalogsFromFile(const base::FilePath& extension_path,
 200                                  base::DictionaryValue* catalogs) {
 201   base::FilePath path = extension_path.AppendASCII(
 202       kDecodedMessageCatalogsFilename);
 203   std::string file_str;
 204   if (!base::ReadFileToString(path, &file_str))
 205     return false;
 206
 207   IPC::Message pickle(file_str.data(), file_str.size());
 208   PickleIterator iter(pickle);
 209   return IPC::ReadParam(&pickle, &iter, catalogs);
 210 }
 211
 212 }  // namespace
 213
 214 SandboxedUnpacker::SandboxedUnpacker(
 215     const base::FilePath& crx_path,
 216     Manifest::Location location,
 217     int creation_flags,
 218     const base::FilePath& extensions_dir,
 219     base::SequencedTaskRunner* unpacker_io_task_runner,
 220     SandboxedUnpackerClient* client)
 221     : crx_path_(crx_path),
 222       client_(client),
 223       extensions_dir_(extensions_dir),
 224       got_response_(false),
 225       location_(location),
 226       creation_flags_(creation_flags),
 227       unpacker_io_task_runner_(unpacker_io_task_runner) {
 228 }
 229
 230 bool SandboxedUnpacker::CreateTempDirectory() {
 231   CHECK(unpacker_io_task_runner_->RunsTasksOnCurrentThread());
 232
 233   base::FilePath temp_dir;
 234   if (!FindWritableTempLocation(extensions_dir_, &temp_dir)) {
 235     ReportFailure(
 236         COULD_NOT_GET_TEMP_DIRECTORY,
 237         l10n_util::GetStringFUTF16(
 238             IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 239             ASCIIToUTF16("COULD_NOT_GET_TEMP_DIRECTORY")));
 240     return false;
 241   }
 242
 243   if (!temp_dir_.CreateUniqueTempDirUnderPath(temp_dir)) {
 244     ReportFailure(
 245         COULD_NOT_CREATE_TEMP_DIRECTORY,
 246         l10n_util::GetStringFUTF16(
 247             IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 248             ASCIIToUTF16("COULD_NOT_CREATE_TEMP_DIRECTORY")));
 249     return false;
 250   }
 251
 252   return true;
 253 }
 254
 255 void SandboxedUnpacker::Start() {
 256   // We assume that we are started on the thread that the client wants us to do
 257   // file IO on.
 258   CHECK(unpacker_io_task_runner_->RunsTasksOnCurrentThread());
 259
 260   unpack_start_time_ = base::TimeTicks::Now();
 261
 262   PATH_LENGTH_HISTOGRAM("Extensions.SandboxUnpackInitialCrxPathLength",
 263                         crx_path_);
 264   if (!CreateTempDirectory())
 265     return;  // ReportFailure() already called.
 266
 267   // Initialize the path that will eventually contain the unpacked extension.
 268   extension_root_ = temp_dir_.path().AppendASCII(kTempExtensionName);
 269   PATH_LENGTH_HISTOGRAM("Extensions.SandboxUnpackUnpackedCrxPathLength",
 270                         extension_root_);
 271
 272   // Extract the public key and validate the package.
 273   if (!ValidateSignature())
 274     return;  // ValidateSignature() already reported the error.
 275
 276   // Copy the crx file into our working directory.
 277   base::FilePath temp_crx_path = temp_dir_.path().Append(crx_path_.BaseName());
 278   PATH_LENGTH_HISTOGRAM("Extensions.SandboxUnpackTempCrxPathLength",
 279                         temp_crx_path);
 280
 281   if (!base::CopyFile(crx_path_, temp_crx_path)) {
 282     // Failed to copy extension file to temporary directory.
 283     ReportFailure(
 284         FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY,
 285         l10n_util::GetStringFUTF16(
 286             IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 287             ASCIIToUTF16("FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY")));
 288     return;
 289   }
 290
 291   // The utility process will have access to the directory passed to
 292   // SandboxedUnpacker.  That directory should not contain a symlink or NTFS
 293   // reparse point.  When the path is used, following the link/reparse point
 294   // will cause file system access outside the sandbox path, and the sandbox
 295   // will deny the operation.
 296   base::FilePath link_free_crx_path;
 297   if (!base::NormalizeFilePath(temp_crx_path, &link_free_crx_path)) {
 298     LOG(ERROR) << "Could not get the normalized path of "
 299                << temp_crx_path.value();
 300     ReportFailure(
 301         COULD_NOT_GET_SANDBOX_FRIENDLY_PATH,
 302         l10n_util::GetStringUTF16(IDS_EXTENSION_UNPACK_FAILED));
 303     return;
 304   }
 305   PATH_LENGTH_HISTOGRAM("Extensions.SandboxUnpackLinkFreeCrxPathLength",
 306                         link_free_crx_path);
 307
 308   BrowserThread::PostTask(
 309       BrowserThread::IO, FROM_HERE,
 310       base::Bind(
 311           &SandboxedUnpacker::StartProcessOnIOThread,
 312           this,
 313           link_free_crx_path));
 314 }
 315
 316 SandboxedUnpacker::~SandboxedUnpacker() {
 317 }
 318
 319 bool SandboxedUnpacker::OnMessageReceived(const IPC::Message& message) {
 320   bool handled = true;
 321   IPC_BEGIN_MESSAGE_MAP(SandboxedUnpacker, message)
 322     IPC_MESSAGE_HANDLER(ChromeUtilityHostMsg_UnpackExtension_Succeeded,
 323                         OnUnpackExtensionSucceeded)
 324     IPC_MESSAGE_HANDLER(ChromeUtilityHostMsg_UnpackExtension_Failed,
 325                         OnUnpackExtensionFailed)
 326     IPC_MESSAGE_UNHANDLED(handled = false)
 327   IPC_END_MESSAGE_MAP()
 328   return handled;
 329 }
 330
 331 void SandboxedUnpacker::OnProcessCrashed(int exit_code) {
 332   // Don't report crashes if they happen after we got a response.
 333   if (got_response_)
 334     return;
 335
 336   // Utility process crashed while trying to install.
 337   ReportFailure(
 338      UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL,
 339      l10n_util::GetStringFUTF16(
 340          IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 341          ASCIIToUTF16("UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL")) +
 342        ASCIIToUTF16(". ") +
 343        l10n_util::GetStringUTF16(IDS_EXTENSION_INSTALL_PROCESS_CRASHED));
 344 }
 345
 346 void SandboxedUnpacker::StartProcessOnIOThread(
 347     const base::FilePath& temp_crx_path) {
 348   UtilityProcessHost* host =
 349       UtilityProcessHost::Create(this, unpacker_io_task_runner_.get());
 350   // Grant the subprocess access to the entire subdir the extension file is
 351   // in, so that it can unpack to that dir.
 352   host->SetExposedDir(temp_crx_path.DirName());
 353   host->Send(
 354       new ChromeUtilityMsg_UnpackExtension(
 355           temp_crx_path, extension_id_, location_, creation_flags_));
 356 }
 357
 358 void SandboxedUnpacker::OnUnpackExtensionSucceeded(
 359     const base::DictionaryValue& manifest) {
 360   CHECK(unpacker_io_task_runner_->RunsTasksOnCurrentThread());
 361   got_response_ = true;
 362
 363   scoped_ptr<base::DictionaryValue> final_manifest(
 364       RewriteManifestFile(manifest));
 365   if (!final_manifest)
 366     return;
 367
 368   // Create an extension object that refers to the temporary location the
 369   // extension was unpacked to. We use this until the extension is finally
 370   // installed. For example, the install UI shows images from inside the
 371   // extension.
 372
 373   // Localize manifest now, so confirm UI gets correct extension name.
 374
 375   // TODO(rdevlin.cronin): Continue removing std::string errors and replacing
 376   // with base::string16
 377   std::string utf8_error;
 378   if (!extension_l10n_util::LocalizeExtension(extension_root_,
 379                                               final_manifest.get(),
 380                                               &utf8_error)) {
 381     ReportFailure(
 382         COULD_NOT_LOCALIZE_EXTENSION,
 383         l10n_util::GetStringFUTF16(
 384             IDS_EXTENSION_PACKAGE_ERROR_MESSAGE,
 385             base::UTF8ToUTF16(utf8_error)));
 386     return;
 387   }
 388
 389   extension_ = Extension::Create(
 390       extension_root_,
 391       location_,
 392       *final_manifest,
 393       Extension::REQUIRE_KEY | creation_flags_,
 394       &utf8_error);
 395
 396   if (!extension_.get()) {
 397     ReportFailure(INVALID_MANIFEST,
 398                   ASCIIToUTF16("Manifest is invalid: " + utf8_error));
 399     return;
 400   }
 401
 402   SkBitmap install_icon;
 403   if (!RewriteImageFiles(&install_icon))
 404     return;
 405
 406   if (!RewriteCatalogFiles())
 407     return;
 408
 409   ReportSuccess(manifest, install_icon);
 410 }
 411
 412 void SandboxedUnpacker::OnUnpackExtensionFailed(const base::string16& error) {
 413   CHECK(unpacker_io_task_runner_->RunsTasksOnCurrentThread());
 414   got_response_ = true;
 415   ReportFailure(
 416       UNPACKER_CLIENT_FAILED,
 417       l10n_util::GetStringFUTF16(
 418            IDS_EXTENSION_PACKAGE_ERROR_MESSAGE,
 419            error));
 420 }
 421
 422 bool SandboxedUnpacker::ValidateSignature() {
 423   ScopedStdioHandle file(base::OpenFile(crx_path_, "rb"));
 424
 425   if (!file.get()) {
 426     // Could not open crx file for reading.
 427 #if defined (OS_WIN)
 428     // On windows, get the error code.
 429     uint32 error_code = ::GetLastError();
 430     // TODO(skerner): Use this histogram to understand why so many
 431     // windows users hit this error.  crbug.com/69693
 432
 433     // Windows errors are unit32s, but all of likely errors are in
 434     // [1, 1000].  See winerror.h for the meaning of specific values.
 435     // Clip errors outside the expected range to a single extra value.
 436     // If there are errors in that extra bucket, we will know to expand
 437     // the range.
 438     const uint32 kMaxErrorToSend = 1001;
 439     error_code = std::min(error_code, kMaxErrorToSend);
 440     UMA_HISTOGRAM_ENUMERATION("Extensions.ErrorCodeFromCrxOpen",
 441                               error_code, kMaxErrorToSend);
 442 #endif
 443
 444     ReportFailure(
 445         CRX_FILE_NOT_READABLE,
 446         l10n_util::GetStringFUTF16(
 447             IDS_EXTENSION_PACKAGE_ERROR_CODE,
 448             ASCIIToUTF16("CRX_FILE_NOT_READABLE")));
 449     return false;
 450   }
 451
 452   // Read and verify the header.
 453   // TODO(erikkay): Yuck.  I'm not a big fan of this kind of code, but it
 454   // appears that we don't have any endian/alignment aware serialization
 455   // code in the code base.  So for now, this assumes that we're running
 456   // on a little endian machine with 4 byte alignment.
 457   CrxFile::Header header;
 458   size_t len = fread(&header, 1, sizeof(header), file.get());
 459   if (len < sizeof(header)) {
 460     // Invalid crx header
 461     ReportFailure(
 462         CRX_HEADER_INVALID,
 463         l10n_util::GetStringFUTF16(
 464             IDS_EXTENSION_PACKAGE_ERROR_CODE,
 465             ASCIIToUTF16("CRX_HEADER_INVALID")));
 466     return false;
 467   }
 468
 469   CrxFile::Error error;
 470   scoped_ptr<CrxFile> crx(CrxFile::Parse(header, &error));
 471   if (!crx) {
 472     switch (error) {
 473       case CrxFile::kWrongMagic:
 474         ReportFailure(
 475             CRX_MAGIC_NUMBER_INVALID,
 476             l10n_util::GetStringFUTF16(
 477                 IDS_EXTENSION_PACKAGE_ERROR_CODE,
 478                 ASCIIToUTF16("CRX_MAGIC_NUMBER_INVALID")));
 479         break;
 480       case CrxFile::kInvalidVersion:
 481         // Bad version numer
 482         ReportFailure(
 483             CRX_VERSION_NUMBER_INVALID,
 484             l10n_util::GetStringFUTF16(
 485                 IDS_EXTENSION_PACKAGE_ERROR_CODE,
 486                 ASCIIToUTF16("CRX_VERSION_NUMBER_INVALID")));
 487         break;
 488       case CrxFile::kInvalidKeyTooLarge:
 489       case CrxFile::kInvalidSignatureTooLarge:
 490         // Excessively large key or signature
 491         ReportFailure(
 492             CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE,
 493             l10n_util::GetStringFUTF16(
 494                 IDS_EXTENSION_PACKAGE_ERROR_CODE,
 495                 ASCIIToUTF16("CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE")));
 496         break;
 497       case CrxFile::kInvalidKeyTooSmall:
 498         // Key length is zero
 499         ReportFailure(
 500             CRX_ZERO_KEY_LENGTH,
 501             l10n_util::GetStringFUTF16(
 502                 IDS_EXTENSION_PACKAGE_ERROR_CODE,
 503                 ASCIIToUTF16("CRX_ZERO_KEY_LENGTH")));
 504         break;
 505       case CrxFile::kInvalidSignatureTooSmall:
 506         // Signature length is zero
 507         ReportFailure(
 508             CRX_ZERO_SIGNATURE_LENGTH,
 509             l10n_util::GetStringFUTF16(
 510                 IDS_EXTENSION_PACKAGE_ERROR_CODE,
 511                 ASCIIToUTF16("CRX_ZERO_SIGNATURE_LENGTH")));
 512         break;
 513     }
 514     return false;
 515   }
 516
 517   std::vector<uint8> key;
 518   key.resize(header.key_size);
 519   len = fread(&key.front(), sizeof(uint8), header.key_size, file.get());
 520   if (len < header.key_size) {
 521     // Invalid public key
 522     ReportFailure(
 523         CRX_PUBLIC_KEY_INVALID,
 524         l10n_util::GetStringFUTF16(
 525             IDS_EXTENSION_PACKAGE_ERROR_CODE,
 526             ASCIIToUTF16("CRX_PUBLIC_KEY_INVALID")));
 527     return false;
 528   }
 529
 530   std::vector<uint8> signature;
 531   signature.resize(header.signature_size);
 532   len = fread(&signature.front(), sizeof(uint8), header.signature_size,
 533       file.get());
 534   if (len < header.signature_size) {
 535     // Invalid signature
 536     ReportFailure(
 537         CRX_SIGNATURE_INVALID,
 538         l10n_util::GetStringFUTF16(
 539             IDS_EXTENSION_PACKAGE_ERROR_CODE,
 540             ASCIIToUTF16("CRX_SIGNATURE_INVALID")));
 541     return false;
 542   }
 543
 544   crypto::SignatureVerifier verifier;
 545   if (!verifier.VerifyInit(extension_misc::kSignatureAlgorithm,
 546                            sizeof(extension_misc::kSignatureAlgorithm),
 547                            &signature.front(),
 548                            signature.size(),
 549                            &key.front(),
 550                            key.size())) {
 551     // Signature verification initialization failed. This is most likely
 552     // caused by a public key in the wrong format (should encode algorithm).
 553     ReportFailure(
 554         CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED,
 555         l10n_util::GetStringFUTF16(
 556             IDS_EXTENSION_PACKAGE_ERROR_CODE,
 557             ASCIIToUTF16("CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED")));
 558     return false;
 559   }
 560
 561   unsigned char buf[1 << 12];
 562   while ((len = fread(buf, 1, sizeof(buf), file.get())) > 0)
 563     verifier.VerifyUpdate(buf, len);
 564
 565   if (!verifier.VerifyFinal()) {
 566     // Signature verification failed
 567     ReportFailure(
 568         CRX_SIGNATURE_VERIFICATION_FAILED,
 569         l10n_util::GetStringFUTF16(
 570             IDS_EXTENSION_PACKAGE_ERROR_CODE,
 571             ASCIIToUTF16("CRX_SIGNATURE_VERIFICATION_FAILED")));
 572     return false;
 573   }
 574
 575   std::string public_key =
 576       std::string(reinterpret_cast<char*>(&key.front()), key.size());
 577   base::Base64Encode(public_key, &public_key_);
 578
 579   extension_id_ = id_util::GenerateId(public_key);
 580
 581   return true;
 582 }
 583
 584 void SandboxedUnpacker::ReportFailure(FailureReason reason,
 585                                       const base::string16& error) {
 586   UMA_HISTOGRAM_ENUMERATION("Extensions.SandboxUnpackFailureReason",
 587                             reason, NUM_FAILURE_REASONS);
 588   UMA_HISTOGRAM_TIMES("Extensions.SandboxUnpackFailureTime",
 589                       base::TimeTicks::Now() - unpack_start_time_);
 590   Cleanup();
 591   client_->OnUnpackFailure(error);
 592 }
 593
 594 void SandboxedUnpacker::ReportSuccess(
 595     const base::DictionaryValue& original_manifest,
 596     const SkBitmap& install_icon) {
 597   UMA_HISTOGRAM_COUNTS("Extensions.SandboxUnpackSuccess", 1);
 598
 599   RecordSuccessfulUnpackTimeHistograms(
 600       crx_path_, base::TimeTicks::Now() - unpack_start_time_);
 601
 602   // Client takes ownership of temporary directory and extension.
 603   client_->OnUnpackSuccess(
 604       temp_dir_.Take(), extension_root_, &original_manifest, extension_.get(),
 605       install_icon);
 606   extension_ = NULL;
 607 }
 608
 609 base::DictionaryValue* SandboxedUnpacker::RewriteManifestFile(
 610     const base::DictionaryValue& manifest) {
 611   // Add the public key extracted earlier to the parsed manifest and overwrite
 612   // the original manifest. We do this to ensure the manifest doesn't contain an
 613   // exploitable bug that could be used to compromise the browser.
 614   scoped_ptr<base::DictionaryValue> final_manifest(manifest.DeepCopy());
 615   final_manifest->SetString(manifest_keys::kPublicKey, public_key_);
 616
 617   std::string manifest_json;
 618   JSONStringValueSerializer serializer(&manifest_json);
 619   serializer.set_pretty_print(true);
 620   if (!serializer.Serialize(*final_manifest)) {
 621     // Error serializing manifest.json.
 622     ReportFailure(
 623         ERROR_SERIALIZING_MANIFEST_JSON,
 624         l10n_util::GetStringFUTF16(
 625             IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 626             ASCIIToUTF16("ERROR_SERIALIZING_MANIFEST_JSON")));
 627     return NULL;
 628   }
 629
 630   base::FilePath manifest_path =
 631       extension_root_.Append(kManifestFilename);
 632   int size = base::checked_cast<int>(manifest_json.size());
 633   if (base::WriteFile(manifest_path, manifest_json.data(), size) != size) {
 634     // Error saving manifest.json.
 635     ReportFailure(
 636         ERROR_SAVING_MANIFEST_JSON,
 637         l10n_util::GetStringFUTF16(
 638             IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 639             ASCIIToUTF16("ERROR_SAVING_MANIFEST_JSON")));
 640     return NULL;
 641   }
 642
 643   return final_manifest.release();
 644 }
 645
 646 bool SandboxedUnpacker::RewriteImageFiles(SkBitmap* install_icon) {
 647   DecodedImages images;
 648   if (!ReadImagesFromFile(temp_dir_.path(), &images)) {
 649     // Couldn't read image data from disk.
 650     ReportFailure(
 651         COULD_NOT_READ_IMAGE_DATA_FROM_DISK,
 652         l10n_util::GetStringFUTF16(
 653             IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 654             ASCIIToUTF16("COULD_NOT_READ_IMAGE_DATA_FROM_DISK")));
 655     return false;
 656   }
 657
 658   // Delete any images that may be used by the browser.  We're going to write
 659   // out our own versions of the parsed images, and we want to make sure the
 660   // originals are gone for good.
 661   std::set<base::FilePath> image_paths =
 662       extension_file_util::GetBrowserImagePaths(extension_.get());
 663   if (image_paths.size() != images.size()) {
 664     // Decoded images don't match what's in the manifest.
 665     ReportFailure(
 666         DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST,
 667         l10n_util::GetStringFUTF16(
 668             IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 669             ASCIIToUTF16("DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST")));
 670     return false;
 671   }
 672
 673   for (std::set<base::FilePath>::iterator it = image_paths.begin();
 674        it != image_paths.end(); ++it) {
 675     base::FilePath path = *it;
 676     if (path.IsAbsolute() || path.ReferencesParent()) {
 677       // Invalid path for browser image.
 678       ReportFailure(
 679           INVALID_PATH_FOR_BROWSER_IMAGE,
 680           l10n_util::GetStringFUTF16(
 681               IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 682               ASCIIToUTF16("INVALID_PATH_FOR_BROWSER_IMAGE")));
 683       return false;
 684     }
 685     if (!base::DeleteFile(extension_root_.Append(path), false)) {
 686       // Error removing old image file.
 687       ReportFailure(
 688           ERROR_REMOVING_OLD_IMAGE_FILE,
 689           l10n_util::GetStringFUTF16(
 690               IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 691               ASCIIToUTF16("ERROR_REMOVING_OLD_IMAGE_FILE")));
 692       return false;
 693     }
 694   }
 695
 696   std::string install_icon_path = IconsInfo::GetIcons(extension_).Get(
 697       extension_misc::EXTENSION_ICON_LARGE,
 698       ExtensionIconSet::MATCH_BIGGER);
 699
 700   // Write our parsed images back to disk as well.
 701   for (size_t i = 0; i < images.size(); ++i) {
 702     if (BrowserThread::GetBlockingPool()->IsShutdownInProgress()) {
 703       // Abort package installation if shutdown was initiated, crbug.com/235525
 704       ReportFailure(
 705           ABORTED_DUE_TO_SHUTDOWN,
 706           l10n_util::GetStringFUTF16(
 707               IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 708               ASCIIToUTF16("ABORTED_DUE_TO_SHUTDOWN")));
 709       return false;
 710     }
 711
 712     const SkBitmap& image = images[i].a;
 713     base::FilePath path_suffix = images[i].b;
 714     if (path_suffix.MaybeAsASCII() == install_icon_path)
 715       *install_icon = image;
 716
 717     if (path_suffix.IsAbsolute() || path_suffix.ReferencesParent()) {
 718       // Invalid path for bitmap image.
 719       ReportFailure(
 720           INVALID_PATH_FOR_BITMAP_IMAGE,
 721           l10n_util::GetStringFUTF16(
 722               IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 723               ASCIIToUTF16("INVALID_PATH_FOR_BITMAP_IMAGE")));
 724       return false;
 725     }
 726     base::FilePath path = extension_root_.Append(path_suffix);
 727
 728     std::vector<unsigned char> image_data;
 729     // TODO(mpcomplete): It's lame that we're encoding all images as PNG, even
 730     // though they may originally be .jpg, etc.  Figure something out.
 731     // http://code.google.com/p/chromium/issues/detail?id=12459
 732     if (!gfx::PNGCodec::EncodeBGRASkBitmap(image, false, &image_data)) {
 733       // Error re-encoding theme image.
 734       ReportFailure(
 735           ERROR_RE_ENCODING_THEME_IMAGE,
 736           l10n_util::GetStringFUTF16(
 737               IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 738               ASCIIToUTF16("ERROR_RE_ENCODING_THEME_IMAGE")));
 739       return false;
 740     }
 741
 742     // Note: we're overwriting existing files that the utility process wrote,
 743     // so we can be sure the directory exists.
 744     const char* image_data_ptr = reinterpret_cast<const char*>(&image_data[0]);
 745     int size = base::checked_cast<int>(image_data.size());
 746     if (base::WriteFile(path, image_data_ptr, size) != size) {
 747       // Error saving theme image.
 748       ReportFailure(
 749           ERROR_SAVING_THEME_IMAGE,
 750           l10n_util::GetStringFUTF16(
 751               IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 752               ASCIIToUTF16("ERROR_SAVING_THEME_IMAGE")));
 753       return false;
 754     }
 755   }
 756
 757   return true;
 758 }
 759
 760 bool SandboxedUnpacker::RewriteCatalogFiles() {
 761   base::DictionaryValue catalogs;
 762   if (!ReadMessageCatalogsFromFile(temp_dir_.path(), &catalogs)) {
 763     // Could not read catalog data from disk.
 764     ReportFailure(
 765         COULD_NOT_READ_CATALOG_DATA_FROM_DISK,
 766         l10n_util::GetStringFUTF16(
 767             IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 768             ASCIIToUTF16("COULD_NOT_READ_CATALOG_DATA_FROM_DISK")));
 769     return false;
 770   }
 771
 772   // Write our parsed catalogs back to disk.
 773   for (base::DictionaryValue::Iterator it(catalogs);
 774        !it.IsAtEnd(); it.Advance()) {
 775     const base::DictionaryValue* catalog = NULL;
 776     if (!it.value().GetAsDictionary(&catalog)) {
 777       // Invalid catalog data.
 778       ReportFailure(
 779           INVALID_CATALOG_DATA,
 780           l10n_util::GetStringFUTF16(
 781               IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 782               ASCIIToUTF16("INVALID_CATALOG_DATA")));
 783       return false;
 784     }
 785
 786     base::FilePath relative_path = base::FilePath::FromUTF8Unsafe(it.key());
 787     relative_path = relative_path.Append(kMessagesFilename);
 788     if (relative_path.IsAbsolute() || relative_path.ReferencesParent()) {
 789       // Invalid path for catalog.
 790       ReportFailure(
 791           INVALID_PATH_FOR_CATALOG,
 792           l10n_util::GetStringFUTF16(
 793               IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 794               ASCIIToUTF16("INVALID_PATH_FOR_CATALOG")));
 795       return false;
 796     }
 797     base::FilePath path = extension_root_.Append(relative_path);
 798
 799     std::string catalog_json;
 800     JSONStringValueSerializer serializer(&catalog_json);
 801     serializer.set_pretty_print(true);
 802     if (!serializer.Serialize(*catalog)) {
 803       // Error serializing catalog.
 804       ReportFailure(
 805           ERROR_SERIALIZING_CATALOG,
 806           l10n_util::GetStringFUTF16(
 807               IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 808               ASCIIToUTF16("ERROR_SERIALIZING_CATALOG")));
 809       return false;
 810     }
 811
 812     // Note: we're overwriting existing files that the utility process read,
 813     // so we can be sure the directory exists.
 814     int size = base::checked_cast<int>(catalog_json.size());
 815     if (base::WriteFile(path, catalog_json.c_str(), size) != size) {
 816       // Error saving catalog.
 817       ReportFailure(
 818           ERROR_SAVING_CATALOG,
 819           l10n_util::GetStringFUTF16(
 820               IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
 821               ASCIIToUTF16("ERROR_SAVING_CATALOG")));
 822       return false;
 823     }
 824   }
 825
 826   return true;
 827 }
 828
 829 void SandboxedUnpacker::Cleanup() {
 830   DCHECK(unpacker_io_task_runner_->RunsTasksOnCurrentThread());
 831   if (!temp_dir_.Delete()) {
 832     LOG(WARNING) << "Can not delete temp directory at "
 833                  << temp_dir_.path().value();
 834   }
 835 }
 836
 837 }  // namespace extensions