Adding file access permissions to fileBrowserHandler manifest.

chrome/browser/chromeos/extensions/file_handler_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/extensions/file_handler_util.h"
 
 #include "base/bind.h"
 #include "base/file_util.h"
 #include "base/i18n/case_conversion.h"
 #include "base/json/json_writer.h"
@@ skipping 86 matching lines @@
         break;
       }
     }
   }
 
   return matching_patterns;
 }
 
 typedef std::set<const FileBrowserHandler*> ActionSet;
 
+const FileBrowserHandler* FindFileBrowserHandler(const Extension* extension,
+                                                 const std::string& action_id) {
+  for (Extension::FileBrowserHandlerList::const_iterator action_iter =
+           extension->file_browser_handlers()->begin();
+       action_iter != extension->file_browser_handlers()->end();
+       ++action_iter) {
+    if (action_iter->get()->id() == action_id)
+      return action_iter->get();
+  }
+  return NULL;
+}
+
+unsigned int GetAccessPermissionsForHandler(const Extension* extension,
+                                            const std::string& action_id) {
+  const FileBrowserHandler* action =
+      FindFileBrowserHandler(extension, action_id);
+  if (!action)
+    return 0;
+  unsigned int result = 0;
+  if (action->CanRead())
+    result |= kReadOnlyFilePermissions;
+  if (action->CanWrite())
+    result |= kReadWriteFilePermissions;
+  // TODO(tbarzic): We don't handle Create yet.
+  return result;
+}
+
+
 std::string EscapedUtf8ToLower(const std::string& str) {
   string16 utf16 = UTF8ToUTF16(
       net::UnescapeURLComponent(str, net::UnescapeRule::NORMAL));
   return net::EscapeUrlEncodedData(
       UTF16ToUTF8(base::i18n::ToLower(utf16)),
       false /* do not replace space with plus */);
 }
 
 bool GetFileBrowserHandlers(Profile* profile,
                             const GURL& selected_file_url,
@@ skipping 161 matching lines @@
 }
 
 class FileTaskExecutor::ExecuteTasksFileSystemCallbackDispatcher {
  public:
   static fileapi::FileSystemContext::OpenFileSystemCallback CreateCallback(
       FileTaskExecutor* executor,
       Profile* profile,
       const GURL& source_url,
       scoped_refptr<const Extension> handler_extension,
       int handler_pid,
+      const std::string& action_id,
       const std::vector<GURL>& file_urls) {
     return base::Bind(
         &ExecuteTasksFileSystemCallbackDispatcher::DidOpenFileSystem,
         base::Owned(new ExecuteTasksFileSystemCallbackDispatcher(
             executor, profile, source_url, handler_extension,
-            handler_pid, file_urls)));
+            handler_pid, action_id, file_urls)));
   }
 
   void DidOpenFileSystem(base::PlatformFileError result,
                          const std::string& file_system_name,
                          const GURL& file_system_root) {
     if (result != base::PLATFORM_FILE_OK) {
       DidFail(result);
       return;
     }
     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
@@ skipping 36 matching lines @@
             executor_));
   }
 
  private:
   ExecuteTasksFileSystemCallbackDispatcher(
       FileTaskExecutor* executor,
       Profile* profile,
       const GURL& source_url,
       const scoped_refptr<const Extension>& handler_extension,
       int handler_pid,
+      const std::string& action_id,
       const std::vector<GURL>& file_urls)
       : executor_(executor),
         profile_(profile),
         source_url_(source_url),
         handler_extension_(handler_extension),
         handler_pid_(handler_pid),
+        action_id_(action_id),
         origin_file_urls_(file_urls) {
     DCHECK(executor_);
   }
 
   // Checks legitimacy of file url and grants file RO access permissions from
   // handler (target) extension and its renderer process.
   bool SetupFileAccessPermissions(const GURL& origin_file_url,
                                   FileDefinition* file) {
     if (!handler_extension_.get())
       return false;
@@ skipping 45 matching lines @@
     // If the file is under gdata mount point, there is no actual file to be
     // found on the final_file_path.
     if (!is_gdata_file) {
       if (!file_util::PathExists(final_file_path) ||
           file_util::IsLink(final_file_path) ||
           !file_util::GetFileInfo(final_file_path, &file_info)) {
         return false;
       }
     }
 
-    // TODO(tbarzic): Add explicit R/W + R/O permissions for non-component
-    // extensions.
-
-    // Grant R/O access permission to non-component extension and R/W to
-    // component extensions.
     ChildProcessSecurityPolicy::GetInstance()->GrantPermissionsForFile(
         handler_pid_,
         final_file_path,
-        GetReadWritePermissions());
+        GetAccessPermissionsForHandler(handler_extension_.get(), action_id_));
 
     // Grant access to this particular file to target extension. This will
     // ensure that the target extension can access only this FS entry and
     // prevent from traversing FS hierarchy upward.
     external_provider->GrantFileAccessToExtension(handler_extension_->id(),
                                                   virtual_path);
 
     // Output values.
     GURL target_origin_url(Extension::GetBaseURLFromExtensionId(
         handler_extension_->id()));
     GURL base_url = fileapi::GetFileSystemRootURI(target_origin_url,
         fileapi::kFileSystemTypeExternal);
     file->target_file_url = GURL(base_url.spec() + virtual_path.value());
     FilePath root(FILE_PATH_LITERAL("/"));
     file->virtual_path = root.Append(virtual_path);
     file->is_directory = file_info.is_directory;
     file->absolute_path = final_file_path;
     return true;
   }
 
   FileTaskExecutor* executor_;
   Profile* profile_;
   // Extension source URL.
   GURL source_url_;
   scoped_refptr<const Extension> handler_extension_;
   int handler_pid_;
+  std::string action_id_;
   std::vector<GURL> origin_file_urls_;
   DISALLOW_COPY_AND_ASSIGN(ExecuteTasksFileSystemCallbackDispatcher);
 };
 
 FileTaskExecutor::FileTaskExecutor(Profile* profile,
                                    const GURL source_url,
                                    const std::string& extension_id,
                                    const std::string& action_id)
   : profile_(profile),
     source_url_(source_url),
@@ skipping 39 matching lines @@
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
   GURL origin_url = handler_base_url.GetOrigin();
   BrowserContext::GetFileSystemContext(profile_)->OpenFileSystem(
       origin_url, fileapi::kFileSystemTypeExternal, false, // create
       ExecuteTasksFileSystemCallbackDispatcher::CreateCallback(
           this,
           profile_,
           source_url_,
           handler,
           handler_pid,
+          action_id_,
           file_urls));
 }
 
 void FileTaskExecutor::ExecuteFailedOnUIThread() {
   Done(false);
 }
 
 void FileTaskExecutor::SetupFileAccessPermissionsForGDataCache(
     const FileDefinitionList& file_list,
     int handler_pid) {
@@ skipping 68 matching lines @@
   base::JSONWriter::Write(event_args.get(), &json_args);
   event_router->DispatchEventToExtension(
       extension_id_, std::string("fileBrowserHandler.onExecute"),
       json_args, profile_,
       GURL());
   Done(true);
 }
 
 } // namespace file_handler_util