Fix file access on Chrome for ChromeOS on Linux

chrome/browser/net/chrome_network_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/net/chrome_network_delegate.h"
 
 #include "base/logging.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/content_settings/cookie_settings.h"
 #include "chrome/browser/content_settings/tab_specific_content_settings.h"
@@ skipping 11 matching lines @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/resource_request_info.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_log.h"
 #include "net/cookies/cookie_monster.h"
 #include "net/http/http_request_headers.h"
 #include "net/http/http_response_headers.h"
 #include "net/url_request/url_request.h"
 
+#if defined(OS_CHROMEOS)
+#include "base/chromeos/chromeos_version.h"
+#endif
+
 #if defined(ENABLE_CONFIGURATION_POLICY)
 #include "chrome/browser/policy/url_blacklist_manager.h"
 #endif
 
 using content::BrowserThread;
 using content::RenderViewHost;
 using content::ResourceRequestInfo;
 
+// By default we don't allow access to all file:// urls on ChromeOS but we do on
+// other platforms.
+#if defined(OS_CHROMEOS)
+bool ChromeNetworkDelegate::g_allow_file_access_ = false;
+#else
+bool ChromeNetworkDelegate::g_allow_file_access_ = true;
+#endif
+
 namespace {
 
 // If the |request| failed due to problems with a proxy, forward the error to
 // the proxy extension API.
 void ForwardProxyErrors(net::URLRequest* request,
                         ExtensionEventRouterForwarder* event_router,
                         void* profile) {
   if (request->status().status() == net::URLRequestStatus::FAILED) {
     switch (request->status().error()) {
       case net::ERR_PROXY_AUTH_UNSUPPORTED:
@@ skipping 77 matching lines @@
 
 // static
 void ChromeNetworkDelegate::InitializeReferrersEnabled(
     BooleanPrefMember* enable_referrers,
     PrefService* pref_service) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   enable_referrers->Init(prefs::kEnableReferrers, pref_service, NULL);
   enable_referrers->MoveToThread(BrowserThread::IO);
 }
 
+// static
+void ChromeNetworkDelegate::AllowAccessToAllFiles() {
+  g_allow_file_access_ = true;
+}
+
 int ChromeNetworkDelegate::OnBeforeURLRequest(
     net::URLRequest* request,
     const net::CompletionCallback& callback,
     GURL* new_url) {
 #if defined(ENABLE_CONFIGURATION_POLICY)
   // TODO(joaodasilva): This prevents extensions from seeing URLs that are
   // blocked. However, an extension might redirect the request to another URL,
   // which is not blocked.
   if (url_blacklist_manager_ &&
       url_blacklist_manager_->IsURLBlocked(request->url())) {
@@ skipping 97 matching lines @@
 ChromeNetworkDelegate::OnAuthRequired(
     net::URLRequest* request,
     const net::AuthChallengeInfo& auth_info,
     const AuthCallback& callback,
     net::AuthCredentials* credentials) {
   return ExtensionWebRequestEventRouter::GetInstance()->OnAuthRequired(
       profile_, extension_info_map_.get(), request, auth_info,
       callback, credentials);
 }
 
-bool ChromeNetworkDelegate::CanGetCookies(
-    const net::URLRequest* request,
+bool ChromeNetworkDelegate::OnCanGetCookies(
+    const net::URLRequest& request,
     const net::CookieList& cookie_list) {
   // NULL during tests, or when we're running in the system context.
   if (!cookie_settings_)
     return true;
 
   bool allow = cookie_settings_->IsReadingCookieAllowed(
-      request->url(), request->first_party_for_cookies());
+      request.url(), request.first_party_for_cookies());
 
   int render_process_id = -1;
   int render_view_id = -1;
   if (content::ResourceRequestInfo::GetRenderViewForRequest(
-          request, &render_process_id, &render_view_id)) {
+          &request, &render_process_id, &render_view_id)) {
     BrowserThread::PostTask(
         BrowserThread::UI, FROM_HERE,
         base::Bind(&TabSpecificContentSettings::CookiesRead,
                    render_process_id, render_view_id,
-                   request->url(), request->first_party_for_cookies(),
+                   request.url(), request.first_party_for_cookies(),
                    cookie_list, !allow));
   }
 
   return allow;
 }
 
-bool ChromeNetworkDelegate::CanSetCookie(
-    const net::URLRequest* request,
-    const std::string& cookie_line,
-    net::CookieOptions* options) {
+bool ChromeNetworkDelegate::OnCanSetCookie(const net::URLRequest& request,
+                                           const std::string& cookie_line,
+                                           net::CookieOptions* options) {
   // NULL during tests, or when we're running in the system context.
   if (!cookie_settings_)
     return true;
 
   bool allow = cookie_settings_->IsSettingCookieAllowed(
-      request->url(), request->first_party_for_cookies());
+      request.url(), request.first_party_for_cookies());
 
-  if (cookie_settings_->IsCookieSessionOnly(request->url()))
+  if (cookie_settings_->IsCookieSessionOnly(request.url()))
     options->set_force_session();
 
   int render_process_id = -1;
   int render_view_id = -1;
   if (content::ResourceRequestInfo::GetRenderViewForRequest(
-          request, &render_process_id, &render_view_id)) {
+          &request, &render_process_id, &render_view_id)) {
     BrowserThread::PostTask(
         BrowserThread::UI, FROM_HERE,
         base::Bind(&TabSpecificContentSettings::CookieChanged,
                    render_process_id, render_view_id,
-                   request->url(), request->first_party_for_cookies(),
+                   request.url(), request.first_party_for_cookies(),
                    cookie_line, *options, !allow));
   }
 
   return allow;
 }
+
+bool ChromeNetworkDelegate::OnCanAccessFile(const net::URLRequest& request,
+                                            const FilePath& path) const {
+  if (g_allow_file_access_)
+    return true;
+
+#if defined(OS_CHROMEOS)
+  // ChromeOS uses a whitelist to only allow access to files residing in the
+  // list of directories below.
+  static const char* const kLocalAccessWhiteList[] = {
+      "/home/chronos/user/Downloads",
+      "/home/chronos/user/log",
+      "/media",
+      "/opt/oem",
+      "/usr/share/chromeos-assets",
+      "/tmp",
+      "/var/log",
+  };
+
+  // If we're running Chrome for ChromeOS on Linux, we want to allow file
+  // access.
+  if (!base::chromeos::IsRunningOnChromeOS())
+    return true;
+
+  for (size_t i = 0; i < arraysize(kLocalAccessWhiteList); ++i) {
+    const FilePath white_listed_path(kLocalAccessWhiteList[i]);
+    // FilePath::operator== should probably handle trailing separators.
+    if (white_listed_path == path.StripTrailingSeparators() ||
+        white_listed_path.IsParent(path)) {
+      return true;
+    }
+  }
+  return false;
+#else
+  return true;
+#endif  // defined(OS_CHROMEOS)
+}