mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 12:39:28 +00:00
Marius Ciepluch
0116f9bea6
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
45 lines
2.0 KiB
C++
45 lines
2.0 KiB
C++
// Provenance: chromium/chromium IsShellIntegratedExtension (fixed).
|
|
// repo: chromium/chromium
|
|
// commit: 22c61cfae5d1b37c773e638d342488ae11118b51
|
|
// parent: a07d0ae0a7dc68686adca10dcf11138cb2f4ab6d
|
|
// commit_url: https://github.com/chromium/chromium/commit/22c61cfae5d1b37c773e638d342488ae11118b51
|
|
// cve: CVE-2022-2162
|
|
// license: BSD-3-Clause
|
|
// function: IsShellIntegratedExtension
|
|
// relpath: content/browser/file_system_access/file_system_chooser.cc
|
|
|
|
bool FileSystemChooser::IsShellIntegratedExtension(
|
|
const base::FilePath::StringType& extension) {
|
|
// TODO(https://crbug.com/1154757): Figure out some way to unify this with
|
|
// net::IsSafePortablePathComponent, with the result probably ending up in
|
|
// base/i18n/file_util_icu.h.
|
|
// - For the sake of consistency across platforms, we sanitize '.lnk' and
|
|
// '.local' files on all platforms (not just Windows)
|
|
// - There are some extensions (i.e. '.scf') we would like to sanitize which
|
|
// `net::GenerateFileName()` does not
|
|
base::FilePath::StringType extension_lower =
|
|
base::ToLowerASCII(GetLastExtension(extension));
|
|
|
|
// '.lnk' and '.scf' files may be used to execute arbitrary code (see
|
|
// https://nvd.nist.gov/vuln/detail/CVE-2010-2568 and
|
|
// https://crbug.com/1227995, respectively). '.local' files are used by
|
|
// Windows to determine which DLLs to load for an application. '.url' files
|
|
// can be used to read arbirtary files (see https://crbug.com/1307930).
|
|
if ((extension_lower == FILE_PATH_LITERAL("lnk")) ||
|
|
(extension_lower == FILE_PATH_LITERAL("local")) ||
|
|
(extension_lower == FILE_PATH_LITERAL("scf")) ||
|
|
(extension_lower == FILE_PATH_LITERAL("url"))) {
|
|
return true;
|
|
}
|
|
|
|
// Setting a file's extension to a CLSID may conceal its actual file type on
|
|
// some Windows versions (see https://nvd.nist.gov/vuln/detail/CVE-2004-0420).
|
|
if (!extension_lower.empty() &&
|
|
(extension_lower.front() == FILE_PATH_LITERAL('{')) &&
|
|
(extension_lower.back() == FILE_PATH_LITERAL('}'))) {
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|