feat: add support for validating asar archives on macOS (#30667)

* feat: add support for validating asar archives on macOS

* chore: fix lint

* chore: update as per feedback

* feat: switch implementation to asar integrity hash checks

* feat: make ranged requests work with the asar file validator DataSourceFilter

* chore: fix lint

* chore: fix missing log include on non-darwin

* fix: do not pull block size out of missing optional

* fix: match ValidateOrDie symbol on non-darwin

* chore: fix up asar specs by repacking archives

* fix: maintain integrity chain, do not load file integrity if header integrity was not loaded

* debug test

* Update node-spec.ts

* fix: initialize header_validated_

* chore: update PR per feedback

* chore: update per feedback

* build: use final asar module

* Update fuses.json5

shell/common/api/electron_api_asar.cc

@@ -32,13 +32,12 @@ class Archive : public gin::Wrappable<Archive> {
   gin::ObjectTemplateBuilder GetObjectTemplateBuilder(
       v8::Isolate* isolate) override {
     return gin::ObjectTemplateBuilder(isolate)
-        .SetProperty("path", &Archive::GetPath)
         .SetMethod("getFileInfo", &Archive::GetFileInfo)
         .SetMethod("stat", &Archive::Stat)
         .SetMethod("readdir", &Archive::Readdir)
         .SetMethod("realpath", &Archive::Realpath)
         .SetMethod("copyFileOut", &Archive::CopyFileOut)
-        .SetMethod("getFd", &Archive::GetFD);
+        .SetMethod("getFdAndValidateIntegrityLater", &Archive::GetFD);
   }
 
   const char* GetTypeName() override { return "Archive"; }
@@ -47,9 +46,6 @@ class Archive : public gin::Wrappable<Archive> {
   Archive(v8::Isolate* isolate, std::unique_ptr<asar::Archive> archive)
       : archive_(std::move(archive)) {}
 
-  // Returns the path of the file.
-  base::FilePath GetPath() { return archive_->path(); }
-
   // Reads the offset and size of file.
   v8::Local<v8::Value> GetFileInfo(v8::Isolate* isolate,
                                    const base::FilePath& path) {
@@ -60,6 +56,20 @@ class Archive : public gin::Wrappable<Archive> {
     dict.Set("size", info.size);
     dict.Set("unpacked", info.unpacked);
     dict.Set("offset", info.offset);
+    if (info.integrity.has_value()) {
+      gin_helper::Dictionary integrity(isolate, v8::Object::New(isolate));
+      asar::HashAlgorithm algorithm = info.integrity.value().algorithm;
+      switch (algorithm) {
+        case asar::HashAlgorithm::SHA256:
+          integrity.Set("algorithm", "SHA256");
+          break;
+        case asar::HashAlgorithm::NONE:
+          CHECK(false);
+          break;
+      }
+      integrity.Set("hash", info.integrity.value().hash);
+      dict.Set("integrity", integrity);
+    }
     return dict.GetHandle();
   }
 
@@ -108,7 +118,7 @@ class Archive : public gin::Wrappable<Archive> {
   int GetFD() const {
     if (!archive_)
       return -1;
-    return archive_->GetFD();
+    return archive_->GetUnsafeFD();
   }
 
  private:

shell/common/asar/archive.cc

@@ -18,6 +18,8 @@
 #include "base/task/post_task.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/values.h"
+#include "electron/fuses.h"
+#include "shell/common/asar/asar_util.h"
 #include "shell/common/asar/scoped_temporary_file.h"
 
 #if defined(OS_WIN)
@@ -95,6 +97,7 @@ bool GetNodeFromPath(std::string path,
 
 bool FillFileInfoWithNode(Archive::FileInfo* info,
                           uint32_t header_size,
+                          bool load_integrity,
                           const base::DictionaryValue* node) {
   int size;
   if (!node->GetInteger("size", &size))
@@ -113,6 +116,42 @@ bool FillFileInfoWithNode(Archive::FileInfo* info,
 
   node->GetBoolean("executable", &info->executable);
 
+#if defined(OS_MAC)
+  if (load_integrity &&
+      electron::fuses::IsEmbeddedAsarIntegrityValidationEnabled()) {
+    const base::DictionaryValue* integrity;
+    if (node->GetDictionary("integrity", &integrity)) {
+      IntegrityPayload integrity_payload;
+      std::string algorithm;
+      const base::ListValue* blocks;
+      int block_size;
+      if (integrity->GetString("algorithm", &algorithm) &&
+          integrity->GetString("hash", &integrity_payload.hash) &&
+          integrity->GetInteger("blockSize", &block_size) &&
+          integrity->GetList("blocks", &blocks) && block_size > 0) {
+        integrity_payload.block_size = static_cast<uint32_t>(block_size);
+        for (size_t i = 0; i < blocks->GetSize(); i++) {
+          std::string block;
+          if (!blocks->GetString(i, &block)) {
+            LOG(FATAL)
+                << "Invalid block integrity value for file in ASAR archive";
+          }
+          integrity_payload.blocks.push_back(block);
+        }
+        if (algorithm == "SHA256") {
+          integrity_payload.algorithm = HashAlgorithm::SHA256;
+          info->integrity = std::move(integrity_payload);
+        }
+      }
+    }
+
+    if (!info->integrity.has_value()) {
+      LOG(FATAL) << "Failed to read integrity for file in ASAR archive";
+      return false;
+    }
+  }
+#endif
+
   return true;
 }
 
@@ -191,6 +230,32 @@ bool Archive::Init() {
     return false;
   }
 
+#if defined(OS_MAC)
+  // Validate header signature if required and possible
+  if (electron::fuses::IsEmbeddedAsarIntegrityValidationEnabled() &&
+      RelativePath().has_value()) {
+    absl::optional<IntegrityPayload> integrity = HeaderIntegrity();
+    if (!integrity.has_value()) {
+      LOG(FATAL) << "Failed to get integrity for validatable asar archive: "
+                 << RelativePath().value();
+      return false;
+    }
+
+    // Currently we only support the sha256 algorithm, we can add support for
+    // more below ensure we read them in preference order from most secure to
+    // least
+    if (integrity.value().algorithm != HashAlgorithm::NONE) {
+      ValidateIntegrityOrDie(header.c_str(), header.length(),
+                             integrity.value());
+    } else {
+      LOG(FATAL) << "No eligible hash for validatable asar archive: "
+                 << RelativePath().value();
+    }
+
+    header_validated_ = true;
+  }
+#endif
+
   absl::optional<base::Value> value = base::JSONReader::Read(header);
   if (!value || !value->is_dict()) {
     LOG(ERROR) << "Failed to parse header";
@@ -203,6 +268,16 @@ bool Archive::Init() {
   return true;
 }
 
+#if !defined(OS_MAC)
+absl::optional<IntegrityPayload> Archive::HeaderIntegrity() const {
+  return absl::optional<IntegrityPayload>();
+}
+
+absl::optional<base::FilePath> Archive::RelativePath() const {
+  return absl::optional<base::FilePath>();
+}
+#endif
+
 bool Archive::GetFileInfo(const base::FilePath& path, FileInfo* info) const {
   if (!header_)
     return false;
@@ -215,7 +290,7 @@ bool Archive::GetFileInfo(const base::FilePath& path, FileInfo* info) const {
   if (node->GetString("link", &link))
     return GetFileInfo(base::FilePath::FromUTF8Unsafe(link), info);
 
-  return FillFileInfoWithNode(info, header_size_, node);
+  return FillFileInfoWithNode(info, header_size_, header_validated_, node);
 }
 
 bool Archive::Stat(const base::FilePath& path, Stats* stats) const {
@@ -238,7 +313,7 @@ bool Archive::Stat(const base::FilePath& path, Stats* stats) const {
     return true;
   }
 
-  return FillFileInfoWithNode(stats, header_size_, node);
+  return FillFileInfoWithNode(stats, header_size_, header_validated_, node);
 }
 
 bool Archive::Readdir(const base::FilePath& path,
@@ -304,7 +379,8 @@ bool Archive::CopyFileOut(const base::FilePath& path, base::FilePath* out) {
 
   auto temp_file = std::make_unique<ScopedTemporaryFile>();
   base::FilePath::StringType ext = path.Extension();
-  if (!temp_file->InitFromFile(&file_, ext, info.offset, info.size))
+  if (!temp_file->InitFromFile(&file_, ext, info.offset, info.size,
+                               info.integrity))
     return false;
 
 #if defined(OS_POSIX)
@@ -319,7 +395,7 @@ bool Archive::CopyFileOut(const base::FilePath& path, base::FilePath* out) {
   return true;
 }
 
-int Archive::GetFD() const {
+int Archive::GetUnsafeFD() const {
   return fd_;
 }
 

shell/common/asar/archive.h

@@ -6,12 +6,14 @@
 #define SHELL_COMMON_ASAR_ARCHIVE_H_
 
 #include <memory>
+#include <string>
 #include <unordered_map>
 #include <vector>
 
 #include "base/files/file.h"
 #include "base/files/file_path.h"
 #include "base/synchronization/lock.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
 
 namespace base {
 class DictionaryValue;
@@ -21,6 +23,19 @@ namespace asar {
 
 class ScopedTemporaryFile;
 
+enum HashAlgorithm {
+  SHA256,
+  NONE,
+};
+
+struct IntegrityPayload {
+  IntegrityPayload() : algorithm(HashAlgorithm::NONE), block_size(0) {}
+  HashAlgorithm algorithm;
+  std::string hash;
+  uint32_t block_size;
+  std::vector<std::string> blocks;
+};
+
 // This class represents an asar package, and provides methods to read
 // information from it. It is thread-safe after |Init| has been called.
 class Archive {
@@ -31,6 +46,7 @@ class Archive {
     bool executable;
     uint32_t size;
     uint64_t offset;
+    absl::optional<IntegrityPayload> integrity;
   };
 
   struct Stats : public FileInfo {
@@ -46,6 +62,9 @@ class Archive {
   // Read and parse the header.
   bool Init();
 
+  absl::optional<IntegrityPayload> HeaderIntegrity() const;
+  absl::optional<base::FilePath> RelativePath() const;
+
   // Get the info of a file.
   bool GetFileInfo(const base::FilePath& path, FileInfo* info) const;
 
@@ -64,12 +83,16 @@ class Archive {
   bool CopyFileOut(const base::FilePath& path, base::FilePath* out);
 
   // Returns the file's fd.
-  int GetFD() const;
+  // Using this fd will not validate the integrity of any files
+  // you read out of the ASAR manually.  Callers are responsible
+  // for integrity validation after this fd is handed over.
+  int GetUnsafeFD() const;
 
   base::FilePath path() const { return path_; }
 
  private:
   bool initialized_;
+  bool header_validated_ = false;
   const base::FilePath path_;
   base::File file_;
   int fd_ = -1;

shell/common/asar/archive_mac.mm

@@ -0,0 +1,65 @@
+// Copyright (c) 2021 Slack Technologies, Inc.
+// Use of this source code is governed by the MIT license that can be
+// found in the LICENSE file.
+
+#include "shell/common/asar/archive.h"
+
+#include <CommonCrypto/CommonDigest.h>
+#include <CoreFoundation/CoreFoundation.h>
+#include <Foundation/Foundation.h>
+
+#include <iomanip>
+#include <string>
+
+#include "base/logging.h"
+#include "base/mac/bundle_locations.h"
+#include "base/mac/foundation_util.h"
+#include "base/mac/scoped_cftyperef.h"
+#include "base/strings/sys_string_conversions.h"
+#include "shell/common/asar/asar_util.h"
+
+namespace asar {
+
+absl::optional<base::FilePath> Archive::RelativePath() const {
+  base::FilePath bundle_path = base::mac::MainBundlePath().Append("Contents");
+
+  base::FilePath relative_path;
+  if (!bundle_path.AppendRelativePath(path_, &relative_path))
+    return absl::nullopt;
+
+  return relative_path;
+}
+
+absl::optional<IntegrityPayload> Archive::HeaderIntegrity() const {
+  absl::optional<base::FilePath> relative_path = RelativePath();
+  // Callers should have already asserted this
+  CHECK(relative_path.has_value());
+
+  NSDictionary* integrity = [[NSBundle mainBundle]
+      objectForInfoDictionaryKey:@"ElectronAsarIntegrity"];
+
+  // Integrity not provided
+  if (!integrity)
+    return absl::nullopt;
+
+  NSString* ns_relative_path =
+      base::mac::FilePathToNSString(relative_path.value());
+
+  NSDictionary* integrity_payload = [integrity objectForKey:ns_relative_path];
+
+  if (!integrity_payload)
+    return absl::nullopt;
+
+  NSString* algorithm = [integrity_payload objectForKey:@"algorithm"];
+  NSString* hash = [integrity_payload objectForKey:@"hash"];
+  if (algorithm && hash && [algorithm isEqualToString:@"SHA256"]) {
+    IntegrityPayload header_integrity;
+    header_integrity.algorithm = HashAlgorithm::SHA256;
+    header_integrity.hash = base::SysNSStringToUTF8(hash);
+    return header_integrity;
+  }
+
+  return absl::nullopt;
+}
+
+}  // namespace asar

shell/common/asar/asar_util.cc

@@ -11,11 +11,16 @@
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/lazy_instance.h"
+#include "base/logging.h"
 #include "base/no_destructor.h"
 #include "base/stl_util.h"
+#include "base/strings/string_number_conversions.h"
+#include "base/strings/string_util.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/thread_local.h"
 #include "base/threading/thread_restrictions.h"
+#include "crypto/secure_hash.h"
+#include "crypto/sha2.h"
 #include "shell/common/asar/archive.h"
 
 namespace asar {
@@ -130,9 +135,38 @@ bool ReadFileToString(const base::FilePath& path, std::string* contents) {
     return false;
 
   contents->resize(info.size);
-  return static_cast<int>(info.size) ==
-         src.Read(info.offset, const_cast<char*>(contents->data()),
-                  contents->size());
+  if (static_cast<int>(info.size) !=
+      src.Read(info.offset, const_cast<char*>(contents->data()),
+               contents->size())) {
+    return false;
+  }
+
+  if (info.integrity.has_value()) {
+    ValidateIntegrityOrDie(contents->data(), contents->size(),
+                           info.integrity.value());
+  }
+
+  return true;
+}
+
+void ValidateIntegrityOrDie(const char* data,
+                            size_t size,
+                            const IntegrityPayload& integrity) {
+  if (integrity.algorithm == HashAlgorithm::SHA256) {
+    uint8_t hash[crypto::kSHA256Length];
+    auto hasher = crypto::SecureHash::Create(crypto::SecureHash::SHA256);
+    hasher->Update(data, size);
+    hasher->Finish(hash, sizeof(hash));
+    const std::string hex_hash =
+        base::ToLowerASCII(base::HexEncode(hash, sizeof(hash)));
+
+    if (integrity.hash != hex_hash) {
+      LOG(FATAL) << "Integrity check failed for asar archive ("
+                 << integrity.hash << " vs " << hex_hash << ")";
+    }
+  } else {
+    LOG(FATAL) << "Unsupported hashing algorithm in ValidateIntegrityOrDie";
+  }
 }
 
 }  // namespace asar

shell/common/asar/asar_util.h

@@ -15,6 +15,7 @@ class FilePath;
 namespace asar {
 
 class Archive;
+struct IntegrityPayload;
 
 // Gets or creates and caches a new Archive from the path.
 std::shared_ptr<Archive> GetOrCreateAsarArchive(const base::FilePath& path);
@@ -31,6 +32,10 @@ bool GetAsarArchivePath(const base::FilePath& full_path,
 // Same with base::ReadFileToString but supports asar Archive.
 bool ReadFileToString(const base::FilePath& path, std::string* contents);
 
+void ValidateIntegrityOrDie(const char* data,
+                            size_t size,
+                            const IntegrityPayload& integrity);
+
 }  // namespace asar
 
 #endif  // SHELL_COMMON_ASAR_ASAR_UTIL_H_

shell/common/asar/scoped_temporary_file.cc

@@ -7,7 +7,9 @@
 #include <vector>
 
 #include "base/files/file_util.h"
+#include "base/logging.h"
 #include "base/threading/thread_restrictions.h"
+#include "shell/common/asar/asar_util.h"
 
 namespace asar {
 
@@ -48,21 +50,28 @@ bool ScopedTemporaryFile::Init(const base::FilePath::StringType& ext) {
   return true;
 }
 
-bool ScopedTemporaryFile::InitFromFile(base::File* src,
-                                       const base::FilePath::StringType& ext,
-                                       uint64_t offset,
-                                       uint64_t size) {
+bool ScopedTemporaryFile::InitFromFile(
+    base::File* src,
+    const base::FilePath::StringType& ext,
+    uint64_t offset,
+    uint64_t size,
+    const absl::optional<IntegrityPayload>& integrity) {
   if (!src->IsValid())
     return false;
 
   if (!Init(ext))
     return false;
 
+  base::ThreadRestrictions::ScopedAllowIO allow_io;
   std::vector<char> buf(size);
   int len = src->Read(offset, buf.data(), buf.size());
   if (len != static_cast<int>(size))
     return false;
 
+  if (integrity.has_value()) {
+    ValidateIntegrityOrDie(buf.data(), buf.size(), integrity.value());
+  }
+
   base::File dest(path_, base::File::FLAG_OPEN | base::File::FLAG_WRITE);
   if (!dest.IsValid())
     return false;

shell/common/asar/scoped_temporary_file.h

@@ -6,6 +6,8 @@
 #define SHELL_COMMON_ASAR_SCOPED_TEMPORARY_FILE_H_
 
 #include "base/files/file_path.h"
+#include "shell/common/asar/archive.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
 
 namespace base {
 class File;
@@ -31,7 +33,8 @@ class ScopedTemporaryFile {
   bool InitFromFile(base::File* src,
                     const base::FilePath::StringType& ext,
                     uint64_t offset,
-                    uint64_t size);
+                    uint64_t size,
+                    const absl::optional<IntegrityPayload>& integrity);
 
   base::FilePath path() const { return path_; }
 

shell/common/node_bindings.cc

@@ -433,13 +433,29 @@ node::Environment* NodeBindings::CreateEnvironment(
       break;
   }
 
-  gin_helper::Dictionary global(context->GetIsolate(), context->Global());
+  v8::Isolate* isolate = context->GetIsolate();
+  gin_helper::Dictionary global(isolate, context->Global());
   // Do not set DOM globals for renderer process.
   // We must set this before the node bootstrapper which is run inside
   // CreateEnvironment
   if (browser_env_ != BrowserEnvironment::kBrowser)
     global.Set("_noBrowserGlobals", true);
 
+  if (browser_env_ == BrowserEnvironment::kBrowser) {
+    const std::vector<std::string> search_paths = {"app.asar", "app",
+                                                   "default_app.asar"};
+    const std::vector<std::string> app_asar_search_paths = {"app.asar"};
+    context->Global()->SetPrivate(
+        context,
+        v8::Private::ForApi(
+            isolate,
+            gin::ConvertToV8(isolate, "appSearchPaths").As<v8::String>()),
+        gin::ConvertToV8(isolate,
+                         electron::fuses::IsOnlyLoadAppFromAsarEnabled()
+                             ? app_asar_search_paths
+                             : search_paths));
+  }
+
   std::vector<std::string> exec_args;
   base::FilePath resources_path = GetResourcesPath();
   std::string init_script = "electron/js2c/" + process_type + "_init";