1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/base/filename_util.h"
6
7 #include "base/files/file_path.h"
8 #include "base/files/file_util.h"
9 #include "base/stl_util.h"
10 #include "base/strings/string_util.h"
11 #include "base/strings/sys_string_conversions.h"
12 #include "base/strings/utf_string_conversions.h"
13 #include "base/threading/thread_restrictions.h"
14 #include "build/build_config.h"
15 #include "net/base/escape.h"
16 #include "net/base/filename_util_internal.h"
17 #include "net/base/mime_util.h"
18 #include "net/base/net_string_util.h"
19 #include "net/http/http_content_disposition.h"
20 #include "url/gurl.h"
21
22 namespace net {
23
24 namespace {
25
26 // Examines the current extension in |file_name| and tries to return the correct
27 // extension the file should actually be using. Used by EnsureSafeExtension.
28 // All other code should use EnsureSafeExtension, as it includes additional
29 // safety checks.
GetCorrectedExtensionUnsafe(const std::string & mime_type,bool ignore_extension,const base::FilePath & file_name)30 base::FilePath::StringType GetCorrectedExtensionUnsafe(
31 const std::string& mime_type,
32 bool ignore_extension,
33 const base::FilePath& file_name) {
34 // See if the file name already contains an extension.
35 base::FilePath::StringType extension = file_name.Extension();
36 if (!extension.empty())
37 extension.erase(extension.begin()); // Erase preceding '.'.
38
39 // Nothing to do if there's no mime type.
40 if (mime_type.empty())
41 return extension;
42
43 // Nothing to do there's an extension, unless |ignore_extension| is true.
44 if (!extension.empty() && !ignore_extension)
45 return extension;
46
47 // Don't do anything if there's not a preferred extension for the mime
48 // type.
49 base::FilePath::StringType preferred_mime_extension;
50 if (!GetPreferredExtensionForMimeType(mime_type, &preferred_mime_extension))
51 return extension;
52
53 // If the existing extension is in the list of valid extensions for the
54 // given type, use it. This avoids doing things like pointlessly renaming
55 // "foo.jpg" to "foo.jpeg".
56 std::vector<base::FilePath::StringType> all_mime_extensions;
57 GetExtensionsForMimeType(mime_type, &all_mime_extensions);
58 if (base::Contains(all_mime_extensions, extension))
59 return extension;
60
61 // Get the "final" extension. In most cases, this is the same as the
62 // |extension|, but in cases like "foo.tar.gz", it's "gz" while
63 // |extension| is "tar.gz".
64 base::FilePath::StringType final_extension = file_name.FinalExtension();
65 // Erase preceding '.'.
66 if (!final_extension.empty())
67 final_extension.erase(final_extension.begin());
68
69 // If there's a double extension, and the second extension is in the
70 // list of valid extensions for the given type, keep the double extension.
71 // This avoids renaming things like "foo.tar.gz" to "foo.gz".
72 if (base::Contains(all_mime_extensions, final_extension))
73 return extension;
74 return preferred_mime_extension;
75 }
76
77 } // namespace
78
SanitizeGeneratedFileName(base::FilePath::StringType * filename,bool replace_trailing)79 void SanitizeGeneratedFileName(base::FilePath::StringType* filename,
80 bool replace_trailing) {
81 const base::FilePath::CharType kReplace[] = FILE_PATH_LITERAL("_");
82 if (filename->empty())
83 return;
84 if (replace_trailing) {
85 // Handle CreateFile() stripping trailing dots and spaces on filenames
86 // http://support.microsoft.com/kb/115827
87 size_t length = filename->size();
88 size_t pos = filename->find_last_not_of(FILE_PATH_LITERAL(" ."));
89 filename->resize((pos == std::string::npos) ? 0 : (pos + 1));
90 #if defined(OS_WIN)
91 base::TrimWhitespace(*filename, base::TRIM_TRAILING, filename);
92 #elif defined(OS_POSIX) || defined(OS_FUCHSIA)
93 base::TrimWhitespaceASCII(*filename, base::TRIM_TRAILING, filename);
94 #else
95 #error Unsupported platform
96 #endif
97
98 if (filename->empty())
99 return;
100 size_t trimmed = length - filename->size();
101 if (trimmed)
102 filename->insert(filename->end(), trimmed, kReplace[0]);
103 }
104 base::TrimString(*filename, FILE_PATH_LITERAL("."), filename);
105 if (filename->empty())
106 return;
107 // Replace any path information by changing path separators.
108 base::ReplaceSubstringsAfterOffset(
109 filename, 0, FILE_PATH_LITERAL("/"), kReplace);
110 base::ReplaceSubstringsAfterOffset(
111 filename, 0, FILE_PATH_LITERAL("\\"), kReplace);
112 }
113
114 // Returns the filename determined from the last component of the path portion
115 // of the URL. Returns an empty string if the URL doesn't have a path or is
116 // invalid. If the generated filename is not reliable,
117 // |should_overwrite_extension| will be set to true, in which case a better
118 // extension should be determined based on the content type.
GetFileNameFromURL(const GURL & url,const std::string & referrer_charset,bool * should_overwrite_extension)119 std::string GetFileNameFromURL(const GURL& url,
120 const std::string& referrer_charset,
121 bool* should_overwrite_extension) {
122 // about: and data: URLs don't have file names, but esp. data: URLs may
123 // contain parts that look like ones (i.e., contain a slash). Therefore we
124 // don't attempt to divine a file name out of them.
125 if (!url.is_valid() || url.SchemeIs("about") || url.SchemeIs("data"))
126 return std::string();
127
128 std::string unescaped_url_filename = base::UnescapeBinaryURLComponent(
129 url.ExtractFileName(), UnescapeRule::NORMAL);
130
131 // The URL's path should be escaped UTF-8, but may not be.
132 std::string decoded_filename = unescaped_url_filename;
133 if (!base::IsStringUTF8(decoded_filename)) {
134 // TODO(jshin): this is probably not robust enough. To be sure, we need
135 // encoding detection.
136 base::string16 utf16_output;
137 if (!referrer_charset.empty() &&
138 ConvertToUTF16(unescaped_url_filename, referrer_charset.c_str(),
139 &utf16_output)) {
140 decoded_filename = base::UTF16ToUTF8(utf16_output);
141 } else {
142 decoded_filename =
143 base::WideToUTF8(base::SysNativeMBToWide(unescaped_url_filename));
144 }
145 }
146 // If the URL contains a (possibly empty) query, assume it is a generator, and
147 // allow the determined extension to be overwritten.
148 *should_overwrite_extension = !decoded_filename.empty() && url.has_query();
149
150 return decoded_filename;
151 }
152
153 // Returns whether the specified extension is automatically integrated into the
154 // windows shell.
IsShellIntegratedExtension(const base::FilePath::StringType & extension)155 bool IsShellIntegratedExtension(const base::FilePath::StringType& extension) {
156 base::FilePath::StringType extension_lower = base::ToLowerASCII(extension);
157
158 // .lnk files may be used to execute arbitrary code (see
159 // https://nvd.nist.gov/vuln/detail/CVE-2010-2568). .local files are used by
160 // Windows to determine which DLLs to load for an application.
161 if ((extension_lower == FILE_PATH_LITERAL("local")) ||
162 (extension_lower == FILE_PATH_LITERAL("lnk")))
163 return true;
164
165 // Setting a file's extension to a CLSID may conceal its actual file type on
166 // some Windows versions (see https://nvd.nist.gov/vuln/detail/CVE-2004-0420).
167 if (!extension_lower.empty() &&
168 (extension_lower.front() == FILE_PATH_LITERAL('{')) &&
169 (extension_lower.back() == FILE_PATH_LITERAL('}')))
170 return true;
171 return false;
172 }
173
174 // Examines the current extension in |file_name| and modifies it if necessary in
175 // order to ensure the filename is safe. If |file_name| doesn't contain an
176 // extension or if |ignore_extension| is true, then a new extension will be
177 // constructed based on the |mime_type|.
178 //
179 // We're addressing two things here:
180 //
181 // 1) Usability. If there is no reliable file extension, we want to guess a
182 // reasonable file extension based on the content type.
183 //
184 // 2) Shell integration. Some file extensions automatically integrate with the
185 // shell. We block these extensions to prevent a malicious web site from
186 // integrating with the user's shell.
EnsureSafeExtension(const std::string & mime_type,bool ignore_extension,base::FilePath * file_name)187 void EnsureSafeExtension(const std::string& mime_type,
188 bool ignore_extension,
189 base::FilePath* file_name) {
190 DCHECK(file_name);
191 base::FilePath::StringType extension =
192 GetCorrectedExtensionUnsafe(mime_type, ignore_extension, *file_name);
193
194 #if defined(OS_WIN)
195 const base::FilePath::CharType kDefaultExtension[] =
196 FILE_PATH_LITERAL("download");
197
198 // Rename shell-integrated extensions.
199 // TODO(asanka): Consider stripping out the bad extension and replacing it
200 // with the preferred extension for the MIME type if one is available.
201 if (IsShellIntegratedExtension(extension))
202 extension = kDefaultExtension;
203 #endif
204
205 *file_name = file_name->ReplaceExtension(extension);
206 }
207
FilePathToString16(const base::FilePath & path,base::string16 * converted)208 bool FilePathToString16(const base::FilePath& path, base::string16* converted) {
209 #if defined(OS_WIN)
210 converted->assign(path.value().begin(), path.value().end());
211 return true;
212 #elif defined(OS_POSIX) || defined(OS_FUCHSIA)
213 std::string component8 = path.AsUTF8Unsafe();
214 return !component8.empty() &&
215 base::UTF8ToUTF16(component8.c_str(), component8.size(), converted);
216 #endif
217 }
218
GetSuggestedFilenameImpl(const GURL & url,const std::string & content_disposition,const std::string & referrer_charset,const std::string & suggested_name,const std::string & mime_type,const std::string & default_name,bool should_replace_extension,ReplaceIllegalCharactersFunction replace_illegal_characters_function)219 base::string16 GetSuggestedFilenameImpl(
220 const GURL& url,
221 const std::string& content_disposition,
222 const std::string& referrer_charset,
223 const std::string& suggested_name,
224 const std::string& mime_type,
225 const std::string& default_name,
226 bool should_replace_extension,
227 ReplaceIllegalCharactersFunction replace_illegal_characters_function) {
228 // TODO: this function to be updated to match the httpbis recommendations.
229 // Talk to abarth for the latest news.
230
231 // We don't translate this fallback string, "download". If localization is
232 // needed, the caller should provide localized fallback in |default_name|.
233 static const base::FilePath::CharType kFinalFallbackName[] =
234 FILE_PATH_LITERAL("download");
235 std::string filename; // In UTF-8
236 bool overwrite_extension = false;
237 bool is_name_from_content_disposition = false;
238 // Try to extract a filename from content-disposition first.
239 if (!content_disposition.empty()) {
240 HttpContentDisposition header(content_disposition, referrer_charset);
241 filename = header.filename();
242 if (!filename.empty())
243 is_name_from_content_disposition = true;
244 }
245
246 // Then try to use the suggested name.
247 if (filename.empty() && !suggested_name.empty())
248 filename = suggested_name;
249
250 // Now try extracting the filename from the URL. GetFileNameFromURL() only
251 // looks at the last component of the URL and doesn't return the hostname as a
252 // failover.
253 if (filename.empty())
254 filename = GetFileNameFromURL(url, referrer_charset, &overwrite_extension);
255
256 // Finally try the URL hostname, but only if there's no default specified in
257 // |default_name|. Some schemes (e.g.: file:, about:, data:) do not have a
258 // host name.
259 if (filename.empty() && default_name.empty() && url.is_valid() &&
260 !url.host().empty()) {
261 // TODO(jungshik) : Decode a 'punycoded' IDN hostname. (bug 1264451)
262 filename = url.host();
263 }
264
265 bool replace_trailing = false;
266 base::FilePath::StringType result_str, default_name_str;
267 #if defined(OS_WIN)
268 replace_trailing = true;
269 result_str = base::UTF8ToWide(filename);
270 default_name_str = base::UTF8ToWide(default_name);
271 #elif defined(OS_POSIX) || defined(OS_FUCHSIA)
272 result_str = filename;
273 default_name_str = default_name;
274 #else
275 #error Unsupported platform
276 #endif
277 SanitizeGeneratedFileName(&result_str, replace_trailing);
278 if (result_str.find_last_not_of(FILE_PATH_LITERAL("-_")) ==
279 base::FilePath::StringType::npos) {
280 result_str = !default_name_str.empty()
281 ? default_name_str
282 : base::FilePath::StringType(kFinalFallbackName);
283 overwrite_extension = false;
284 }
285 replace_illegal_characters_function(&result_str, '_');
286 base::FilePath result(result_str);
287 overwrite_extension |= should_replace_extension;
288 // extension should not appended to filename derived from
289 // content-disposition, if it does not have one.
290 // Hence mimetype and overwrite_extension values are not used.
291 if (is_name_from_content_disposition)
292 GenerateSafeFileName("", false, &result);
293 else
294 GenerateSafeFileName(mime_type, overwrite_extension, &result);
295
296 base::string16 result16;
297 if (!FilePathToString16(result, &result16)) {
298 result = base::FilePath(default_name_str);
299 if (!FilePathToString16(result, &result16)) {
300 result = base::FilePath(kFinalFallbackName);
301 FilePathToString16(result, &result16);
302 }
303 }
304 return result16;
305 }
306
GenerateFileNameImpl(const GURL & url,const std::string & content_disposition,const std::string & referrer_charset,const std::string & suggested_name,const std::string & mime_type,const std::string & default_file_name,bool should_replace_extension,ReplaceIllegalCharactersFunction replace_illegal_characters_function)307 base::FilePath GenerateFileNameImpl(
308 const GURL& url,
309 const std::string& content_disposition,
310 const std::string& referrer_charset,
311 const std::string& suggested_name,
312 const std::string& mime_type,
313 const std::string& default_file_name,
314 bool should_replace_extension,
315 ReplaceIllegalCharactersFunction replace_illegal_characters_function) {
316 base::string16 file_name = GetSuggestedFilenameImpl(
317 url, content_disposition, referrer_charset, suggested_name, mime_type,
318 default_file_name, should_replace_extension,
319 replace_illegal_characters_function);
320
321 #if defined(OS_WIN)
322 base::FilePath generated_name(base::AsWStringPiece(file_name));
323 #elif defined(OS_POSIX) || defined(OS_FUCHSIA)
324 base::FilePath generated_name(
325 base::SysWideToNativeMB(base::UTF16ToWide(file_name)));
326 #endif
327
328 DCHECK(!generated_name.empty());
329
330 return generated_name;
331 }
332
333 } // namespace net
334