extensions/browser/sandboxed_unpacker.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
   6 #define CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_
   7
   8 #include <string>
   9
  10 #include "base/files/file_path.h"
  11 #include "base/files/scoped_temp_dir.h"
  12 #include "base/memory/ref_counted.h"
  13 #include "base/time/time.h"
  14 #include "content/public/browser/utility_process_host_client.h"
  15 #include "extensions/browser/crx_file_info.h"
  16 #include "extensions/common/manifest.h"
  17
  18 class SkBitmap;
  19
  20 namespace base {
  21 class DictionaryValue;
  22 class SequencedTaskRunner;
  23 }
  24
  25 namespace crypto {
  26 class SecureHash;
  27 }
  28
  29 namespace extensions {
  30 class Extension;
  31
  32 class SandboxedUnpackerClient
  33     : public base::RefCountedThreadSafe<SandboxedUnpackerClient> {
  34  public:
  35   // temp_dir - A temporary directory containing the results of the extension
  36   // unpacking. The client is responsible for deleting this directory.
  37   //
  38   // extension_root - The path to the extension root inside of temp_dir.
  39   //
  40   // original_manifest - The parsed but unmodified version of the manifest,
  41   // with no modifications such as localization, etc.
  42   //
  43   // extension - The extension that was unpacked. The client is responsible
  44   // for deleting this memory.
  45   //
  46   // install_icon - The icon we will display in the installation UI, if any.
  47   virtual void OnUnpackSuccess(const base::FilePath& temp_dir,
  48                                const base::FilePath& extension_root,
  49                                const base::DictionaryValue* original_manifest,
  50                                const Extension* extension,
  51                                const SkBitmap& install_icon) = 0;
  52   virtual void OnUnpackFailure(const base::string16& error) = 0;
  53
  54  protected:
  55   friend class base::RefCountedThreadSafe<SandboxedUnpackerClient>;
  56
  57   virtual ~SandboxedUnpackerClient() {}
  58 };
  59
  60 // SandboxedUnpacker unpacks extensions from the CRX format into a
  61 // directory. This is done in a sandboxed subprocess to protect the browser
  62 // process from parsing complex formats like JPEG or JSON from untrusted
  63 // sources.
  64 //
  65 // Unpacking an extension using this class makes minor changes to its source,
  66 // such as transcoding all images to PNG, parsing all message catalogs
  67 // and rewriting the manifest JSON. As such, it should not be used when the
  68 // output is not intended to be given back to the author.
  69 //
  70 //
  71 // Lifetime management:
  72 //
  73 // This class is ref-counted by each call it makes to itself on another thread,
  74 // and by UtilityProcessHost.
  75 //
  76 // Additionally, we hold a reference to our own client so that it lives at least
  77 // long enough to receive the result of unpacking.
  78 //
  79 //
  80 // NOTE: This class should only be used on the file thread.
  81 class SandboxedUnpacker : public content::UtilityProcessHostClient {
  82  public:
  83   // Unpacks the extension in |crx_path| into a temporary directory and calls
  84   // |client| with the result. If |run_out_of_process| is provided, unpacking
  85   // is done in a sandboxed subprocess. Otherwise, it is done in-process.
  86   SandboxedUnpacker(
  87       const CRXFileInfo& file,
  88       Manifest::Location location,
  89       int creation_flags,
  90       const base::FilePath& extensions_dir,
  91       const scoped_refptr<base::SequencedTaskRunner>& unpacker_io_task_runner,
  92       SandboxedUnpackerClient* client);
  93
  94   // Start unpacking the extension. The client is called with the results.
  95   void Start();
  96
  97  private:
  98   class ProcessHostClient;
  99
 100   // Enumerate all the ways unpacking can fail.  Calls to ReportFailure()
 101   // take a failure reason as an argument, and put it in histogram
 102   // Extensions.SandboxUnpackFailureReason.
 103   enum FailureReason {
 104     // SandboxedUnpacker::CreateTempDirectory()
 105     COULD_NOT_GET_TEMP_DIRECTORY,
 106     COULD_NOT_CREATE_TEMP_DIRECTORY,
 107
 108     // SandboxedUnpacker::Start()
 109     FAILED_TO_COPY_EXTENSION_FILE_TO_TEMP_DIRECTORY,
 110     COULD_NOT_GET_SANDBOX_FRIENDLY_PATH,
 111
 112     // SandboxedUnpacker::OnUnpackExtensionSucceeded()
 113     COULD_NOT_LOCALIZE_EXTENSION,
 114     INVALID_MANIFEST,
 115
 116     // SandboxedUnpacker::OnUnpackExtensionFailed()
 117     UNPACKER_CLIENT_FAILED,
 118
 119     // SandboxedUnpacker::OnProcessCrashed()
 120     UTILITY_PROCESS_CRASHED_WHILE_TRYING_TO_INSTALL,
 121
 122     // SandboxedUnpacker::ValidateSignature()
 123     CRX_FILE_NOT_READABLE,
 124     CRX_HEADER_INVALID,
 125     CRX_MAGIC_NUMBER_INVALID,
 126     CRX_VERSION_NUMBER_INVALID,
 127     CRX_EXCESSIVELY_LARGE_KEY_OR_SIGNATURE,
 128     CRX_ZERO_KEY_LENGTH,
 129     CRX_ZERO_SIGNATURE_LENGTH,
 130     CRX_PUBLIC_KEY_INVALID,
 131     CRX_SIGNATURE_INVALID,
 132     CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED,
 133     CRX_SIGNATURE_VERIFICATION_FAILED,
 134
 135     // SandboxedUnpacker::RewriteManifestFile()
 136     ERROR_SERIALIZING_MANIFEST_JSON,
 137     ERROR_SAVING_MANIFEST_JSON,
 138
 139     // SandboxedUnpacker::RewriteImageFiles()
 140     COULD_NOT_READ_IMAGE_DATA_FROM_DISK,
 141     DECODED_IMAGES_DO_NOT_MATCH_THE_MANIFEST,
 142     INVALID_PATH_FOR_BROWSER_IMAGE,
 143     ERROR_REMOVING_OLD_IMAGE_FILE,
 144     INVALID_PATH_FOR_BITMAP_IMAGE,
 145     ERROR_RE_ENCODING_THEME_IMAGE,
 146     ERROR_SAVING_THEME_IMAGE,
 147     ABORTED_DUE_TO_SHUTDOWN,
 148
 149     // SandboxedUnpacker::RewriteCatalogFiles()
 150     COULD_NOT_READ_CATALOG_DATA_FROM_DISK,
 151     INVALID_CATALOG_DATA,
 152     INVALID_PATH_FOR_CATALOG,
 153     ERROR_SERIALIZING_CATALOG,
 154     ERROR_SAVING_CATALOG,
 155
 156     // SandboxedUnpacker::ValidateSignature()
 157     CRX_HASH_VERIFICATION_FAILED,
 158
 159     NUM_FAILURE_REASONS
 160   };
 161
 162   friend class ProcessHostClient;
 163   friend class SandboxedUnpackerTest;
 164
 165   ~SandboxedUnpacker() override;
 166
 167   // Set |temp_dir_| as a temporary directory to unpack the extension in.
 168   // Return true on success.
 169   virtual bool CreateTempDirectory();
 170
 171   // Finalizes hash calculation and checks the result against the expected
 172   // package hash. In case of mismatch, depending on the command-line option,
 173   // we will either fail installation, or just update histograms.
 174   bool FinalizeHash(scoped_ptr<crypto::SecureHash>& hash);
 175
 176   // Validates the signature of the extension and extract the key to
 177   // |public_key_|. Returns true if the signature validates, false otherwise.
 178   //
 179   // NOTE: Having this method here is a bit ugly. This code should really live
 180   // in extensions::Unpacker as it is not specific to sandboxed unpacking. It
 181   // was put here because we cannot run windows crypto code in the sandbox. But
 182   // we could still have this method statically on extensions::Unpacker so that
 183   // code just for unpacking is there and code just for sandboxing of unpacking
 184   // is here.
 185   bool ValidateSignature();
 186
 187   // Starts the utility process that unpacks our extension.
 188   void StartProcessOnIOThread(const base::FilePath& temp_crx_path);
 189
 190   // UtilityProcessHostClient
 191   bool OnMessageReceived(const IPC::Message& message) override;
 192   void OnProcessCrashed(int exit_code) override;
 193
 194   // IPC message handlers.
 195   void OnUnpackExtensionSucceeded(const base::DictionaryValue& manifest);
 196   void OnUnpackExtensionFailed(const base::string16& error_message);
 197
 198   void ReportFailure(FailureReason reason, const base::string16& message);
 199   void ReportSuccess(const base::DictionaryValue& original_manifest,
 200                      const SkBitmap& install_icon);
 201
 202   // Overwrites original manifest with safe result from utility process.
 203   // Returns NULL on error. Caller owns the returned object.
 204   base::DictionaryValue* RewriteManifestFile(
 205       const base::DictionaryValue& manifest);
 206
 207   // Overwrites original files with safe results from utility process.
 208   // Reports error and returns false if it fails.
 209   bool RewriteImageFiles(SkBitmap* install_icon);
 210   bool RewriteCatalogFiles();
 211
 212   // Cleans up temp directory artifacts.
 213   void Cleanup();
 214
 215   // The path to the CRX to unpack.
 216   base::FilePath crx_path_;
 217
 218   // The package hash that was reported from the Web Store.
 219   std::string package_hash_;
 220
 221   // Whether we need to check the .crx hash sum.
 222   bool check_crx_hash_;
 223
 224   // Our client.
 225   scoped_refptr<SandboxedUnpackerClient> client_;
 226
 227   // The Extensions directory inside the profile.
 228   base::FilePath extensions_dir_;
 229
 230   // A temporary directory to use for unpacking.
 231   base::ScopedTempDir temp_dir_;
 232
 233   // The root directory of the unpacked extension. This is a child of temp_dir_.
 234   base::FilePath extension_root_;
 235
 236   // Represents the extension we're unpacking.
 237   scoped_refptr<Extension> extension_;
 238
 239   // Whether we've received a response from the utility process yet.
 240   bool got_response_;
 241
 242   // The public key that was extracted from the CRX header.
 243   std::string public_key_;
 244
 245   // The extension's ID. This will be calculated from the public key in the crx
 246   // header.
 247   std::string extension_id_;
 248
 249   // Time at which unpacking started. Used to compute the time unpacking takes.
 250   base::TimeTicks unpack_start_time_;
 251
 252   // Location to use for the unpacked extension.
 253   Manifest::Location location_;
 254
 255   // Creation flags to use for the extension.  These flags will be used
 256   // when calling Extenion::Create() by the crx installer.
 257   int creation_flags_;
 258
 259   // Sequenced task runner where file I/O operations will be performed at.
 260   scoped_refptr<base::SequencedTaskRunner> unpacker_io_task_runner_;
 261 };
 262
 263 }  // namespace extensions
 264
 265 #endif  // CHROME_BROWSER_EXTENSIONS_SANDBOXED_UNPACKER_H_