1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/base/filename_util.h"
6
7 #include "base/files/file_path.h"
8 #include "base/files/file_util.h"
9 #include "base/path_service.h"
10 #include "base/strings/string_util.h"
11 #include "base/strings/sys_string_conversions.h"
12 #include "base/strings/utf_string_conversions.h"
13 #include "base/threading/thread_restrictions.h"
14 #include "net/base/escape.h"
15 #include "net/base/filename_util_internal.h"
16 #include "net/base/mime_util.h"
17 #include "net/base/net_string_util.h"
18 #include "net/http/http_content_disposition.h"
19 #include "url/gurl.h"
20
21 namespace net {
22
SanitizeGeneratedFileName(base::FilePath::StringType * filename,bool replace_trailing)23 void SanitizeGeneratedFileName(base::FilePath::StringType* filename,
24 bool replace_trailing) {
25 const base::FilePath::CharType kReplace[] = FILE_PATH_LITERAL("-");
26 if (filename->empty())
27 return;
28 if (replace_trailing) {
29 // Handle CreateFile() stripping trailing dots and spaces on filenames
30 // http://support.microsoft.com/kb/115827
31 size_t length = filename->size();
32 size_t pos = filename->find_last_not_of(FILE_PATH_LITERAL(" ."));
33 filename->resize((pos == std::string::npos) ? 0 : (pos + 1));
34 base::TrimWhitespace(*filename, base::TRIM_TRAILING, filename);
35 if (filename->empty())
36 return;
37 size_t trimmed = length - filename->size();
38 if (trimmed)
39 filename->insert(filename->end(), trimmed, kReplace[0]);
40 }
41 base::TrimString(*filename, FILE_PATH_LITERAL("."), filename);
42 if (filename->empty())
43 return;
44 // Replace any path information by changing path separators.
45 ReplaceSubstringsAfterOffset(filename, 0, FILE_PATH_LITERAL("/"), kReplace);
46 ReplaceSubstringsAfterOffset(filename, 0, FILE_PATH_LITERAL("\\"), kReplace);
47 }
48
49 // Returns the filename determined from the last component of the path portion
50 // of the URL. Returns an empty string if the URL doesn't have a path or is
51 // invalid. If the generated filename is not reliable,
52 // |should_overwrite_extension| will be set to true, in which case a better
53 // extension should be determined based on the content type.
GetFileNameFromURL(const GURL & url,const std::string & referrer_charset,bool * should_overwrite_extension)54 std::string GetFileNameFromURL(const GURL& url,
55 const std::string& referrer_charset,
56 bool* should_overwrite_extension) {
57 // about: and data: URLs don't have file names, but esp. data: URLs may
58 // contain parts that look like ones (i.e., contain a slash). Therefore we
59 // don't attempt to divine a file name out of them.
60 if (!url.is_valid() || url.SchemeIs("about") || url.SchemeIs("data"))
61 return std::string();
62
63 const std::string unescaped_url_filename = UnescapeURLComponent(
64 url.ExtractFileName(),
65 UnescapeRule::SPACES | UnescapeRule::URL_SPECIAL_CHARS);
66
67 // The URL's path should be escaped UTF-8, but may not be.
68 std::string decoded_filename = unescaped_url_filename;
69 if (!base::IsStringUTF8(decoded_filename)) {
70 // TODO(jshin): this is probably not robust enough. To be sure, we need
71 // encoding detection.
72 base::string16 utf16_output;
73 if (!referrer_charset.empty() &&
74 net::ConvertToUTF16(
75 unescaped_url_filename, referrer_charset.c_str(), &utf16_output)) {
76 decoded_filename = base::UTF16ToUTF8(utf16_output);
77 } else {
78 decoded_filename =
79 base::WideToUTF8(base::SysNativeMBToWide(unescaped_url_filename));
80 }
81 }
82 // If the URL contains a (possibly empty) query, assume it is a generator, and
83 // allow the determined extension to be overwritten.
84 *should_overwrite_extension = !decoded_filename.empty() && url.has_query();
85
86 return decoded_filename;
87 }
88
89 // Returns whether the specified extension is automatically integrated into the
90 // windows shell.
IsShellIntegratedExtension(const base::FilePath::StringType & extension)91 bool IsShellIntegratedExtension(const base::FilePath::StringType& extension) {
92 base::FilePath::StringType extension_lower =
93 base::StringToLowerASCII(extension);
94
95 // http://msdn.microsoft.com/en-us/library/ms811694.aspx
96 // Right-clicking on shortcuts can be magical.
97 if ((extension_lower == FILE_PATH_LITERAL("local")) ||
98 (extension_lower == FILE_PATH_LITERAL("lnk")))
99 return true;
100
101 // http://www.juniper.net/security/auto/vulnerabilities/vuln2612.html
102 // Files become magical if they end in a CLSID, so block such extensions.
103 if (!extension_lower.empty() &&
104 (extension_lower[0] == FILE_PATH_LITERAL('{')) &&
105 (extension_lower[extension_lower.length() - 1] == FILE_PATH_LITERAL('}')))
106 return true;
107 return false;
108 }
109
110 // Returns whether the specified file name is a reserved name on windows.
111 // This includes names like "com2.zip" (which correspond to devices) and
112 // desktop.ini and thumbs.db which have special meaning to the windows shell.
IsReservedName(const base::FilePath::StringType & filename)113 bool IsReservedName(const base::FilePath::StringType& filename) {
114 // This list is taken from the MSDN article "Naming a file"
115 // http://msdn2.microsoft.com/en-us/library/aa365247(VS.85).aspx
116 // I also added clock$ because GetSaveFileName seems to consider it as a
117 // reserved name too.
118 static const char* const known_devices[] = {
119 "con", "prn", "aux", "nul", "com1", "com2", "com3", "com4",
120 "com5", "com6", "com7", "com8", "com9", "lpt1", "lpt2", "lpt3",
121 "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9", "clock$"};
122 #if defined(OS_WIN)
123 std::string filename_lower =
124 base::StringToLowerASCII(base::WideToUTF8(filename));
125 #elif defined(OS_POSIX)
126 std::string filename_lower = base::StringToLowerASCII(filename);
127 #endif
128
129 for (size_t i = 0; i < arraysize(known_devices); ++i) {
130 // Exact match.
131 if (filename_lower == known_devices[i])
132 return true;
133 // Starts with "DEVICE.".
134 if (filename_lower.find(std::string(known_devices[i]) + ".") == 0)
135 return true;
136 }
137
138 static const char* const magic_names[] = {
139 // These file names are used by the "Customize folder" feature of the shell.
140 "desktop.ini",
141 "thumbs.db",
142 };
143
144 for (size_t i = 0; i < arraysize(magic_names); ++i) {
145 if (filename_lower == magic_names[i])
146 return true;
147 }
148
149 return false;
150 }
151
152 // Examines the current extension in |file_name| and modifies it if necessary in
153 // order to ensure the filename is safe. If |file_name| doesn't contain an
154 // extension or if |ignore_extension| is true, then a new extension will be
155 // constructed based on the |mime_type|.
156 //
157 // We're addressing two things here:
158 //
159 // 1) Usability. If there is no reliable file extension, we want to guess a
160 // reasonable file extension based on the content type.
161 //
162 // 2) Shell integration. Some file extensions automatically integrate with the
163 // shell. We block these extensions to prevent a malicious web site from
164 // integrating with the user's shell.
EnsureSafeExtension(const std::string & mime_type,bool ignore_extension,base::FilePath * file_name)165 void EnsureSafeExtension(const std::string& mime_type,
166 bool ignore_extension,
167 base::FilePath* file_name) {
168 // See if our file name already contains an extension.
169 base::FilePath::StringType extension = file_name->Extension();
170 if (!extension.empty())
171 extension.erase(extension.begin()); // Erase preceding '.'.
172
173 if ((ignore_extension || extension.empty()) && !mime_type.empty()) {
174 base::FilePath::StringType preferred_mime_extension;
175 std::vector<base::FilePath::StringType> all_mime_extensions;
176 net::GetPreferredExtensionForMimeType(mime_type, &preferred_mime_extension);
177 net::GetExtensionsForMimeType(mime_type, &all_mime_extensions);
178 // If the existing extension is in the list of valid extensions for the
179 // given type, use it. This avoids doing things like pointlessly renaming
180 // "foo.jpg" to "foo.jpeg".
181 if (std::find(all_mime_extensions.begin(),
182 all_mime_extensions.end(),
183 extension) != all_mime_extensions.end()) {
184 // leave |extension| alone
185 } else if (!preferred_mime_extension.empty()) {
186 extension = preferred_mime_extension;
187 }
188 }
189
190 #if defined(OS_WIN)
191 static const base::FilePath::CharType default_extension[] =
192 FILE_PATH_LITERAL("download");
193
194 // Rename shell-integrated extensions.
195 // TODO(asanka): Consider stripping out the bad extension and replacing it
196 // with the preferred extension for the MIME type if one is available.
197 if (IsShellIntegratedExtension(extension))
198 extension.assign(default_extension);
199 #endif
200
201 *file_name = file_name->ReplaceExtension(extension);
202 }
203
FilePathToString16(const base::FilePath & path,base::string16 * converted)204 bool FilePathToString16(const base::FilePath& path, base::string16* converted) {
205 #if defined(OS_WIN)
206 return base::WideToUTF16(
207 path.value().c_str(), path.value().size(), converted);
208 #elif defined(OS_POSIX)
209 std::string component8 = path.AsUTF8Unsafe();
210 return !component8.empty() &&
211 base::UTF8ToUTF16(component8.c_str(), component8.size(), converted);
212 #endif
213 }
214
GetSuggestedFilenameImpl(const GURL & url,const std::string & content_disposition,const std::string & referrer_charset,const std::string & suggested_name,const std::string & mime_type,const std::string & default_name,ReplaceIllegalCharactersCallback replace_illegal_characters_callback)215 base::string16 GetSuggestedFilenameImpl(
216 const GURL& url,
217 const std::string& content_disposition,
218 const std::string& referrer_charset,
219 const std::string& suggested_name,
220 const std::string& mime_type,
221 const std::string& default_name,
222 ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
223 // TODO: this function to be updated to match the httpbis recommendations.
224 // Talk to abarth for the latest news.
225
226 // We don't translate this fallback string, "download". If localization is
227 // needed, the caller should provide localized fallback in |default_name|.
228 static const base::FilePath::CharType kFinalFallbackName[] =
229 FILE_PATH_LITERAL("download");
230 std::string filename; // In UTF-8
231 bool overwrite_extension = false;
232
233 // Try to extract a filename from content-disposition first.
234 if (!content_disposition.empty()) {
235 HttpContentDisposition header(content_disposition, referrer_charset);
236 filename = header.filename();
237 }
238
239 // Then try to use the suggested name.
240 if (filename.empty() && !suggested_name.empty())
241 filename = suggested_name;
242
243 // Now try extracting the filename from the URL. GetFileNameFromURL() only
244 // looks at the last component of the URL and doesn't return the hostname as a
245 // failover.
246 if (filename.empty())
247 filename = GetFileNameFromURL(url, referrer_charset, &overwrite_extension);
248
249 // Finally try the URL hostname, but only if there's no default specified in
250 // |default_name|. Some schemes (e.g.: file:, about:, data:) do not have a
251 // host name.
252 if (filename.empty() && default_name.empty() && url.is_valid() &&
253 !url.host().empty()) {
254 // TODO(jungshik) : Decode a 'punycoded' IDN hostname. (bug 1264451)
255 filename = url.host();
256 }
257
258 bool replace_trailing = false;
259 base::FilePath::StringType result_str, default_name_str;
260 #if defined(OS_WIN)
261 replace_trailing = true;
262 result_str = base::UTF8ToUTF16(filename);
263 default_name_str = base::UTF8ToUTF16(default_name);
264 #else
265 result_str = filename;
266 default_name_str = default_name;
267 #endif
268 SanitizeGeneratedFileName(&result_str, replace_trailing);
269 if (result_str.find_last_not_of(FILE_PATH_LITERAL("-_")) ==
270 base::FilePath::StringType::npos) {
271 result_str = !default_name_str.empty()
272 ? default_name_str
273 : base::FilePath::StringType(kFinalFallbackName);
274 overwrite_extension = false;
275 }
276 replace_illegal_characters_callback.Run(&result_str, '-');
277 base::FilePath result(result_str);
278 GenerateSafeFileName(mime_type, overwrite_extension, &result);
279
280 base::string16 result16;
281 if (!FilePathToString16(result, &result16)) {
282 result = base::FilePath(default_name_str);
283 if (!FilePathToString16(result, &result16)) {
284 result = base::FilePath(kFinalFallbackName);
285 FilePathToString16(result, &result16);
286 }
287 }
288 return result16;
289 }
290
GenerateFileNameImpl(const GURL & url,const std::string & content_disposition,const std::string & referrer_charset,const std::string & suggested_name,const std::string & mime_type,const std::string & default_file_name,ReplaceIllegalCharactersCallback replace_illegal_characters_callback)291 base::FilePath GenerateFileNameImpl(
292 const GURL& url,
293 const std::string& content_disposition,
294 const std::string& referrer_charset,
295 const std::string& suggested_name,
296 const std::string& mime_type,
297 const std::string& default_file_name,
298 ReplaceIllegalCharactersCallback replace_illegal_characters_callback) {
299 base::string16 file_name =
300 GetSuggestedFilenameImpl(url,
301 content_disposition,
302 referrer_charset,
303 suggested_name,
304 mime_type,
305 default_file_name,
306 replace_illegal_characters_callback);
307
308 #if defined(OS_WIN)
309 base::FilePath generated_name(file_name);
310 #else
311 base::FilePath generated_name(
312 base::SysWideToNativeMB(base::UTF16ToWide(file_name)));
313 #endif
314
315 DCHECK(!generated_name.empty());
316
317 return generated_name;
318 }
319
320 } // namespace net
321