Fix directory traversal in extension_resources.cc. Adds test case, which is complicated by several…

chrome/common/extensions/extension_resource_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 
 #include "base/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/path_service.h"
 #include "chrome/common/chrome_paths.h"
@@ skipping 31 matching lines @@
   EXPECT_EQ(relative_path.value(), resource.relative_path().value());
   EXPECT_TRUE(resource.GetFilePath().empty());
 }
 
 TEST(ExtensionResourceTest, ResourcesOutsideOfPath) {
   base::ScopedTempDir temp;
   ASSERT_TRUE(temp.CreateUniqueTempDir());
 
   FilePath inner_dir = temp.path().AppendASCII("directory");
   ASSERT_TRUE(file_util::CreateDirectory(inner_dir));
+  FilePath sub_dir = inner_dir.AppendASCII("subdir");
+  ASSERT_TRUE(file_util::CreateDirectory(sub_dir));
   FilePath inner_file = inner_dir.AppendASCII("inner");
   FilePath outer_file = temp.path().AppendASCII("outer");
   ASSERT_TRUE(file_util::WriteFile(outer_file, "X", 1));
   ASSERT_TRUE(file_util::WriteFile(inner_file, "X", 1));
   std::string extension_id = extension_test_util::MakeId("test");
 
 #if defined(OS_POSIX)
   FilePath symlink_file = inner_dir.AppendASCII("symlink");
   file_util::CreateSymbolicLink(
       FilePath().AppendASCII("..").AppendASCII("outer"),
@@ skipping 17 matching lines @@
                        FilePath().AppendASCII("inner"));
   r3.set_follow_symlinks_anywhere();
   EXPECT_FALSE(r3.GetFilePath().empty());
 
   // ... but, again, not a relative path that walks out of |inner_dir|.
   ExtensionResource r4(extension_id, inner_dir,
                        FilePath().AppendASCII("..").AppendASCII("outer"));
   r4.set_follow_symlinks_anywhere();
   EXPECT_TRUE(r4.GetFilePath().empty());
 
+  // ... and not even when clever current-directory syntax is present. Note
+  // that the path for this test case can't start with the current directory
+  // component due to quirks in FilePath::Append(), and the path must exist.
+  ExtensionResource r4a(
+      extension_id, inner_dir,
+      FilePath().AppendASCII("subdir").AppendASCII(".").AppendASCII("..").
+      AppendASCII("..").AppendASCII("outer"));
+  r4a.set_follow_symlinks_anywhere();
+  EXPECT_TRUE(r4a.GetFilePath().empty());
+
 #if defined(OS_POSIX)
   // The non-packing extension should also not be able to access a resource that
   // symlinks out of the directory.
   ExtensionResource r5(extension_id, inner_dir,
                        FilePath().AppendASCII("symlink"));
   EXPECT_TRUE(r5.GetFilePath().empty());
 
   // ... but a packing extension can.
   ExtensionResource r6(extension_id, inner_dir,
                        FilePath().AppendASCII("symlink"));
@@ skipping 42 matching lines @@
   // See http://crbug.com/27359.
   expected_path = root_resource;
   ASSERT_TRUE(file_util::AbsolutePath(&expected_path));
 
   EXPECT_EQ(ToLower(expected_path.value()), ToLower(resolved_path.value()));
   EXPECT_EQ(ToLower(temp.path().value()),
             ToLower(resource.extension_root().value()));
   EXPECT_EQ(ToLower(FilePath().AppendASCII(filename).value()),
             ToLower(resource.relative_path().value()));
 }