toolkit/xre/ModuleEvaluator.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
   6
   7 #include "ModuleEvaluator.h"
   8
   9 #include <algorithm>  // For std::find()
  10 #include <type_traits>
  11
  12 #include <windows.h>
  13 #include <shlobj.h>
  14
  15 #include "mozilla/ArrayUtils.h"
  16 #include "mozilla/ModuleVersionInfo.h"
  17 #include "mozilla/UniquePtr.h"
  18 #include "mozilla/Unused.h"
  19 #include "mozilla/WinDllServices.h"
  20 #include "mozilla/WinHeaderOnlyUtils.h"
  21 #include "nsReadableUtils.h"
  22 #include "nsWindowsHelpers.h"
  23 #include "nsXULAppAPI.h"
  24
  25 // Fills a Vector with keyboard layout DLLs found in the registry.
  26 // These are leaf names only, not full paths. Here we will convert them to
  27 // lowercase before returning, to facilitate case-insensitive searches.
  28 // On error, this may return partial results.
  29 static Vector<nsString> GetKeyboardLayoutDlls() {
  30   Vector<nsString> result;
  31
  32   HKEY rawKey;
  33   if (::RegOpenKeyExW(HKEY_LOCAL_MACHINE,
  34                       L"SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts",
  35                       0, KEY_ENUMERATE_SUB_KEYS, &rawKey) != ERROR_SUCCESS) {
  36     return result;
  37   }
  38   nsAutoRegKey key(rawKey);
  39
  40   DWORD iKey = 0;
  41   wchar_t strTemp[MAX_PATH] = {};
  42   while (true) {
  43     DWORD strTempSize = ArrayLength(strTemp);
  44     if (RegEnumKeyExW(rawKey, iKey, strTemp, &strTempSize, nullptr, nullptr,
  45                       nullptr, nullptr) != ERROR_SUCCESS) {
  46       // ERROR_NO_MORE_ITEMS or a real error: bail with what we have.
  47       return result;
  48     }
  49     iKey++;
  50
  51     strTempSize = sizeof(strTemp);
  52     if (::RegGetValueW(rawKey, strTemp, L"Layout File", RRF_RT_REG_SZ, nullptr,
  53                        strTemp, &strTempSize) == ERROR_SUCCESS &&
  54         strTempSize) {
  55       nsString ws(strTemp, ((strTempSize + 1) / sizeof(wchar_t)) - 1);
  56       ToLowerCase(ws);  // To facilitate case-insensitive searches
  57       Unused << result.emplaceBack(std::move(ws));
  58     }
  59   }
  60
  61   return result;
  62 }
  63
  64 namespace mozilla {
  65
  66 /* static */
  67 bool ModuleEvaluator::ResolveKnownFolder(REFKNOWNFOLDERID aFolderId,
  68                                          nsIFile** aOutFile) {
  69   if (!aOutFile) {
  70     return false;
  71   }
  72
  73   *aOutFile = nullptr;
  74
  75   // Since we're running off main thread, we can't use NS_GetSpecialDirectory
  76   PWSTR rawPath = nullptr;
  77   HRESULT hr =
  78       ::SHGetKnownFolderPath(aFolderId, KF_FLAG_DEFAULT, nullptr, &rawPath);
  79   if (FAILED(hr)) {
  80     return false;
  81   }
  82
  83   using ShellStringUniquePtr =
  84       UniquePtr<std::remove_pointer_t<PWSTR>, CoTaskMemFreeDeleter>;
  85
  86   ShellStringUniquePtr path(rawPath);
  87
  88   nsresult rv = NS_NewLocalFile(nsDependentString(path.get()), false, aOutFile);
  89   return NS_SUCCEEDED(rv);
  90 }
  91
  92 ModuleEvaluator::ModuleEvaluator()
  93     : mKeyboardLayoutDlls(GetKeyboardLayoutDlls()) {
  94   MOZ_ASSERT(XRE_IsParentProcess());
  95
  96 #if defined(_M_IX86)
  97   // We want to resolve to SYSWOW64 when applicable
  98   REFKNOWNFOLDERID systemFolderId = FOLDERID_SystemX86;
  99 #else
 100   REFKNOWNFOLDERID systemFolderId = FOLDERID_System;
 101 #endif  // defined(_M_IX86)
 102
 103   bool resolveOk =
 104       ResolveKnownFolder(systemFolderId, getter_AddRefs(mSysDirectory));
 105   MOZ_ASSERT(resolveOk);
 106   if (!resolveOk) {
 107     return;
 108   }
 109
 110   nsCOMPtr<nsIFile> winSxSDir;
 111   resolveOk = ResolveKnownFolder(FOLDERID_Windows, getter_AddRefs(winSxSDir));
 112   MOZ_ASSERT(resolveOk);
 113   if (!resolveOk) {
 114     return;
 115   }
 116
 117   nsresult rv = winSxSDir->Append(u"WinSxS"_ns);
 118   MOZ_ASSERT(NS_SUCCEEDED(rv));
 119   if (NS_FAILED(rv)) {
 120     return;
 121   }
 122
 123   mWinSxSDirectory = std::move(winSxSDir);
 124
 125   nsCOMPtr<nsIFile> exeFile;
 126   rv = XRE_GetBinaryPath(getter_AddRefs(exeFile));
 127   MOZ_ASSERT(NS_SUCCEEDED(rv));
 128   if (NS_FAILED(rv)) {
 129     return;
 130   }
 131
 132   rv = exeFile->GetParent(getter_AddRefs(mExeDirectory));
 133   MOZ_ASSERT(NS_SUCCEEDED(rv));
 134   if (NS_FAILED(rv)) {
 135     return;
 136   }
 137
 138   nsAutoString exePath;
 139   rv = exeFile->GetPath(exePath);
 140   MOZ_ASSERT(NS_SUCCEEDED(rv));
 141   if (NS_FAILED(rv)) {
 142     return;
 143   }
 144
 145   ModuleVersionInfo exeVi;
 146   if (!exeVi.GetFromImage(exePath)) {
 147     return;
 148   }
 149
 150   mExeVersion = Some(ModuleVersion(exeVi.mFileVersion.Version64()));
 151 }
 152
 153 ModuleEvaluator::operator bool() const {
 154   return mExeVersion.isSome() && mExeDirectory && mSysDirectory &&
 155          mWinSxSDirectory;
 156 }
 157
 158 Maybe<ModuleTrustFlags> ModuleEvaluator::GetTrust(
 159     const ModuleRecord& aModuleRecord) const {
 160   MOZ_ASSERT(XRE_IsParentProcess());
 161
 162   // We start by checking authenticode signatures, as the presence of any
 163   // signature will produce an immediate pass/fail.
 164   if (aModuleRecord.mVendorInfo.isSome() &&
 165       aModuleRecord.mVendorInfo.ref().mSource ==
 166           VendorInfo::Source::Signature) {
 167     const nsString& signedBy = aModuleRecord.mVendorInfo.ref().mVendor;
 168
 169     if (signedBy.EqualsLiteral("Microsoft Windows")) {
 170       return Some(ModuleTrustFlags::MicrosoftWindowsSignature);
 171     } else if (signedBy.EqualsLiteral("Microsoft Corporation")) {
 172       return Some(ModuleTrustFlags::MicrosoftWindowsSignature);
 173     } else if (signedBy.EqualsLiteral("Mozilla Corporation")) {
 174       return Some(ModuleTrustFlags::MozillaSignature);
 175     } else {
 176       // Being signed by somebody who is neither Microsoft nor us is an
 177       // automatic and immediate disqualification.
 178       return Some(ModuleTrustFlags::None);
 179     }
 180   }
 181
 182   const nsCOMPtr<nsIFile>& dllFile = aModuleRecord.mResolvedDosName;
 183   MOZ_ASSERT(!!dllFile);
 184   if (!dllFile) {
 185     return Nothing();
 186   }
 187
 188   nsAutoString dllLeafLower;
 189   if (NS_FAILED(dllFile->GetLeafName(dllLeafLower))) {
 190     return Nothing();
 191   }
 192
 193   ToLowerCase(dllLeafLower);  // To facilitate case-insensitive searching
 194
 195   // The JIT profiling module doesn't really have any other practical way to
 196   // match; hard-code it as being trusted.
 197   if (dllLeafLower.EqualsLiteral("jitpi.dll")) {
 198     return Some(ModuleTrustFlags::JitPI);
 199   }
 200
 201   ModuleTrustFlags result = ModuleTrustFlags::None;
 202
 203   nsresult rv;
 204   bool contained;
 205
 206   // Is the DLL in the system directory?
 207   rv = mSysDirectory->Contains(dllFile, &contained);
 208   if (NS_SUCCEEDED(rv) && contained) {
 209     result |= ModuleTrustFlags::SystemDirectory;
 210   }
 211
 212   // Is the DLL in the WinSxS directory? Some Microsoft DLLs (e.g. comctl32) are
 213   // loaded from here and don't have digital signatures. So while this is not a
 214   // guarantee of trustworthiness, but is at least as valid as system32.
 215   rv = mWinSxSDirectory->Contains(dllFile, &contained);
 216   if (NS_SUCCEEDED(rv) && contained) {
 217     result |= ModuleTrustFlags::WinSxSDirectory;
 218   }
 219
 220   // Is it a keyboard layout DLL?
 221   if (std::find(mKeyboardLayoutDlls.begin(), mKeyboardLayoutDlls.end(),
 222                 dllLeafLower) != mKeyboardLayoutDlls.end()) {
 223     result |= ModuleTrustFlags::KeyboardLayout;
 224     // This doesn't guarantee trustworthiness by itself. Keyboard layouts also
 225     // must be in the system directory.
 226   }
 227
 228   if (aModuleRecord.mVendorInfo.isSome() &&
 229       aModuleRecord.mVendorInfo.ref().mSource ==
 230           VendorInfo::Source::VersionInfo) {
 231     const nsString& companyName = aModuleRecord.mVendorInfo.ref().mVendor;
 232
 233     if (companyName.EqualsLiteral("Microsoft Corporation")) {
 234       result |= ModuleTrustFlags::MicrosoftVersion;
 235     }
 236   }
 237
 238   rv = mExeDirectory->Contains(dllFile, &contained);
 239   if (NS_SUCCEEDED(rv) && contained) {
 240     result |= ModuleTrustFlags::FirefoxDirectory;
 241
 242     // If the DLL is in the Firefox directory, does it also share the Firefox
 243     // version info?
 244     if (mExeVersion.isSome() && aModuleRecord.mVersion.isSome() &&
 245         mExeVersion.value() == aModuleRecord.mVersion.value()) {
 246       result |= ModuleTrustFlags::FirefoxDirectoryAndVersion;
 247     }
 248   }
 249
 250   return Some(result);
 251 }
 252
 253 }  // namespace mozilla