Commit message: None
CVE: CVE-2012-5155
CWE: CWE-264
Vulnerability description: Google Chrome before 24.0.1312.52 on Mac OS X does not use an appropriate sandboxing approach for worker processes, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors.

Project: Chrome

bool ReturnsInvalidPath(int dir_type) {
  base::FilePath path;
  bool result = PathService::Get(dir_type, &path);
  return !result && path.empty();
}

Project: Chrome

  int AggregateProfilesIntoAutofillPrefs(const std::string& filename) {
    CHECK(test_server()->Start());

    std::string data;
    base::FilePath data_file =
        ui_test_utils::GetTestFilePath(base::FilePath().AppendASCII("autofill"),
                                       base::FilePath().AppendASCII(filename));
    CHECK(file_util::ReadFileToString(data_file, &data));
    std::vector<std::string> lines;
    base::SplitString(data, '\n', &lines);
    for (size_t i = 0; i < lines.size(); ++i) {
      if (StartsWithASCII(lines[i], "#", false))
        continue;
      std::vector<std::string> fields;
      base::SplitString(lines[i], '|', &fields);
      if (fields.empty())
        continue;  // Blank line.
      CHECK_EQ(12u, fields.size());

      FormMap data;
      data["NAME_FIRST"] = fields[0];
      data["NAME_MIDDLE"] = fields[1];
      data["NAME_LAST"] = fields[2];
      data["EMAIL_ADDRESS"] = fields[3];
      data["COMPANY_NAME"] = fields[4];
      data["ADDRESS_HOME_LINE1"] = fields[5];
      data["ADDRESS_HOME_LINE2"] = fields[6];
      data["ADDRESS_HOME_CITY"] = fields[7];
      data["ADDRESS_HOME_STATE"] = fields[8];
      data["ADDRESS_HOME_ZIP"] = fields[9];
      data["ADDRESS_HOME_COUNTRY"] = fields[10];
      data["PHONE_HOME_WHOLE_NUMBER"] = fields[11];

      FillFormAndSubmit("duplicate_profiles_test.html", data);
    }
    return lines.size();
  }

Project: Chrome

  AutofillTest() {}

Project: Chrome

  void CreateTestProfile() {
    AutofillProfile profile;
    autofill_test::SetProfileInfo(
        &profile, "Milton", "C.", "Waddams",
        "red.swingline@initech.com", "Initech", "4120 Freidrich Lane",
        "Basement", "Austin", "Texas", "78744", "United States", "5125551234");

    WindowedPersonalDataManagerObserver observer(browser());
    personal_data_manager()->AddProfile(profile);

    observer.Wait();
  }

Project: Chrome

  void FillFormAndSubmit(const std::string& filename, const FormMap& data) {
    GURL url = test_server()->GetURL("files/autofill/" + filename);
    ui_test_utils::NavigateToURL(browser(), url);

    std::string js;
    for (FormMap::const_iterator i = data.begin(); i != data.end(); ++i) {
      js += "document.getElementById('" + i->first + "').value = '" +
            i->second + "';";
    }
    js += "document.getElementById('testform').submit();";

    WindowedPersonalDataManagerObserver observer(browser());
    ASSERT_TRUE(content::ExecuteScript(render_view_host(), js));
    observer.Wait();
  }

Project: Chrome

  void FocusFirstNameField() {
    LOG(WARNING) << "Clicking on the tab.";
    content::SimulateMouseClick(
        browser()->tab_strip_model()->GetActiveWebContents(),
        0,
        WebKit::WebMouseEvent::ButtonLeft);

    LOG(WARNING) << "Focusing the first name field.";
    bool result = false;
    ASSERT_TRUE(content::ExecuteScriptAndExtractBool(
        render_view_host(),
        "if (document.readyState === 'complete')"
        "  document.getElementById('firstname').focus();"
        "else"
        "  domAutomationController.send(false);",
        &result));
    ASSERT_TRUE(result);
  }

Project: Chrome

  void PopulateForm(const std::string& field_id) {
    std::string js("document.getElementById('" + field_id + "').focus();");
    ASSERT_TRUE(content::ExecuteScript(render_view_host(), js));

    SendKeyToPageAndWait(ui::VKEY_DOWN);
    SendKeyToPopupAndWait(ui::VKEY_DOWN);
    SendKeyToPopupAndWait(ui::VKEY_RETURN);
  }

Project: Chrome

  void SendKeyToPopupAndWait(ui::KeyboardCode key) {
    if (!external_delegate_) {
      SendKeyToPageAndWait(key);
      return;
    }

    content::NativeWebKeyboardEvent event;
    event.windowsKeyCode = key;
    test_delegate_.Reset();
    external_delegate_->keyboard_listener()->HandleKeyPressEvent(event);
    test_delegate_.Wait();
  }

Project: Chrome

  void SetCard(const CreditCard& card) {
    std::vector<CreditCard> cards;
    cards.push_back(card);
    SetCards(&cards);
  }

Project: Chrome

  void SetCards(std::vector<CreditCard>* cards) {
    WindowedPersonalDataManagerObserver observer(browser());
    personal_data_manager()->SetCreditCards(cards);
    observer.Wait();
  }

Project: Chrome

  void SetProfiles(std::vector<AutofillProfile>* profiles) {
    WindowedPersonalDataManagerObserver observer(browser());
    personal_data_manager()->SetProfiles(profiles);
    observer.Wait();
  }

Project: Chrome

  void SimulateURLFetch(bool success) {
    net::TestURLFetcher* fetcher = url_fetcher_factory_.GetFetcherByID(0);
    ASSERT_TRUE(fetcher);
    net::URLRequestStatus status;
    status.set_status(success ? net::URLRequestStatus::SUCCESS :
                                net::URLRequestStatus::FAILED);

    std::string script = " var google = {};"
        "google.translate = (function() {"
        "  return {"
        "    TranslateService: function() {"
        "      return {"
        "        isAvailable : function() {"
        "          return true;"
        "        },"
        "        restore : function() {"
        "          return;"
        "        },"
        "        getDetectedLanguage : function() {"
        "          return \"ja\";"
        "        },"
        "        translatePage : function(originalLang, targetLang,"
        "                                 onTranslateProgress) {"
        "          document.getElementsByTagName(\"body\")[0].innerHTML = '" +
        std::string(kTestFormString) +
        "              ';"
        "          onTranslateProgress(100, true, false);"
        "        }"
        "      };"
        "    }"
        "  };"
        "})();";

    fetcher->set_url(fetcher->GetOriginalURL());
    fetcher->set_status(status);
    fetcher->set_response_code(success ? 200 : 500);
    fetcher->SetResponseString(script);
    fetcher->delegate()->OnURLFetchComplete(fetcher);
  }

Project: Chrome

  void SubmitCreditCard(const char* name,
                        const char* number,
                        const char* exp_month,
                        const char* exp_year) {
    FormMap data;
    data["CREDIT_CARD_NAME"] = name;
    data["CREDIT_CARD_NUMBER"] = number;
    data["CREDIT_CARD_EXP_MONTH"] = exp_month;
    data["CREDIT_CARD_EXP_4_DIGIT_YEAR"] = exp_year;
    FillFormAndSubmit("autofill_creditcard_form.html", data);
  }

Project: Chrome

  TestAutofillExternalDelegate(content::WebContents* web_contents,
                               AutofillManager* autofill_manager)
      : AutofillExternalDelegate(web_contents, autofill_manager),
        keyboard_listener_(NULL) {
  }

Project: Chrome

  void TryBasicFormFill() {
    FocusFirstNameField();

    LOG(WARNING) << "Typing 'M' to bring up the Autofill popup.";
    SendKeyToPageAndWait(ui::VKEY_M);

    LOG(WARNING) << "Simulating down arrow press to initiate Autofill preview.";
    SendKeyToPopupAndWait(ui::VKEY_DOWN);

    ExpectFieldValue("firstname", "M");
    ExpectFieldValue("lastname", "");
    ExpectFieldValue("address1", "");
    ExpectFieldValue("address2", "");
    ExpectFieldValue("city", "");
    ExpectFieldValue("state", "");
    ExpectFieldValue("zip", "");
    ExpectFieldValue("country", "");
    ExpectFieldValue("phone", "");

    LOG(WARNING) << "Simulating Return press to fill the form.";
    SendKeyToPopupAndWait(ui::VKEY_RETURN);

    ExpectFilledTestForm();
  }

Project: Chrome

  TestAutofillExternalDelegate* external_delegate() {
    return external_delegate_.get();
  }

Project: Chrome

  content::KeyboardListener* keyboard_listener() {
    return keyboard_listener_;
  }

Project: Chrome

  PersonalDataManager* personal_data_manager() {
    return PersonalDataManagerFactory::GetForProfile(browser()->profile());
  }

Project: Chrome

  RenderViewHost* render_view_host() {
    return browser()->tab_strip_model()->GetActiveWebContents()->
        GetRenderViewHost();
  }

Project: Chrome

  virtual ~WindowedPersonalDataManagerObserver() {
    if (!infobar_service_)
      return;

    InfoBarDelegate* infobar = NULL;
    if (infobar_service_->GetInfoBarCount() > 0 &&
        (infobar = infobar_service_->GetInfoBarDelegateAt(0))) {
      infobar_service_->RemoveInfoBar(infobar);
    }
  }

Project: Chrome

void DownloadPathReservationTrackerTest::CallGetReservedPath(
    DownloadItem& download_item,
    const base::FilePath& target_path,
    bool uniquify_path,
    base::FilePath* return_path,
    bool* return_verified) {
  base::WeakPtrFactory<DownloadPathReservationTrackerTest> weak_ptr_factory(
      this);
  bool did_run_callback = false;
  DownloadPathReservationTracker::GetReservedPath(
      download_item, target_path, default_download_path(), uniquify_path,
      base::Bind(&DownloadPathReservationTrackerTest::TestReservedPathCallback,
                 weak_ptr_factory.GetWeakPtr(), return_path, return_verified,
                 &did_run_callback));
  message_loop_.RunUntilIdle();
  EXPECT_TRUE(did_run_callback);
}

Project: Chrome

FakeDownloadItem* DownloadPathReservationTrackerTest::CreateDownloadItem(
    int32 id) {
  FakeDownloadItem* item = new ::testing::StrictMock<FakeDownloadItem>;
  DownloadId download_id(reinterpret_cast<void*>(this), id);
  EXPECT_CALL(*item, GetGlobalId())
      .WillRepeatedly(Return(download_id));
  EXPECT_CALL(*item, GetTargetFilePath())
      .WillRepeatedly(ReturnRefOfCopy(base::FilePath()));
  return item;
}

Project: Chrome

DownloadPathReservationTrackerTest::DownloadPathReservationTrackerTest()
    : ui_thread_(BrowserThread::UI, &message_loop_),
      file_thread_(BrowserThread::FILE, &message_loop_) {
}

Project: Chrome

  explicit FakeDownloadItem()
      : state_(IN_PROGRESS) {
  }

Project: Chrome

DownloadPathReservationTrackerTest::GetLongNamePathInDownloadsDirectory(
    size_t repeat, const base::FilePath::CharType* suffix) {
  return GetPathInDownloadsDirectory(
      (base::FilePath::StringType(repeat, FILE_PATH_LITERAL('a'))
          + suffix).c_str());
}

Project: Chrome

base::FilePath DownloadPathReservationTrackerTest::GetPathInDownloadsDirectory(
    const base::FilePath::CharType* suffix) {
  return default_download_path().Append(suffix).NormalizePathSeparators();
}

Project: Chrome

bool DownloadPathReservationTrackerTest::IsPathInUse(
    const base::FilePath& path) {
  return DownloadPathReservationTracker::IsPathInUseForTesting(path);
}

Project: Chrome

  void SetState(DownloadState state) {
    state_ = state;
    UpdateObservers();
  }

Project: Chrome

void DownloadPathReservationTrackerTest::SetUp() {
  ASSERT_TRUE(test_download_dir_.CreateUniqueTempDir());
  set_default_download_path(test_download_dir_.path());
}

Project: Chrome

void DownloadPathReservationTrackerTest::TearDown() {
  message_loop_.RunUntilIdle();
}

Project: Chrome

void DownloadPathReservationTrackerTest::TestReservedPathCallback(
    base::FilePath* return_path, bool* return_verified, bool* did_run_callback,
    const base::FilePath& path, bool verified) {
  *did_run_callback = true;
  *return_path = path;
  *return_verified = verified;
}

Project: Chrome

  const base::FilePath& default_download_path() const {
    return default_download_path_;
  }

Project: Chrome

  void set_default_download_path(const base::FilePath& path) {
    default_download_path_ = path;
  }

Project: Chrome

  virtual ~FakeDownloadItem() {
    FOR_EACH_OBSERVER(Observer, observers_, OnDownloadDestroyed(this));
    EXPECT_EQ(0u, observers_.size());
  }

Project: Chrome

  FullscreenTestBrowserWindow() : fullscreen_(false) {}

Project: Chrome

  virtual ~BrowserCommandControllerFullscreenTest() {}

Project: Chrome

  virtual ~FullscreenTestBrowserWindow() {}