Hi Nathan!

I think this will fall under your team?  If so, would you mind checking labels.

Thanks for confirming labels Varun.

Not a low severity vulnerability, this is a safebrowing issue.

Robert -- Is this something you could take a swing at?  If it's a matter of using the same first-u32-checking logic that the DMG analyzer uses, that should be straightforward.  

But now I'm wondering, should we be trusting extensions on Mac at all?  Should we instead be looking at contents?  I've experimented just a bit and found that PNGs can be downloaded and opened without any extension, so it seems Mac is doing some content-sniffing. 

No, I won't have time to do this for at least a few quarters.

To identify Mach-O files you do just need to check the file's u32 magic (mostly, though note the issue I mentioned with that above). As I alluded to in  https://crbug.com/600613#c5 , Mac doesn't just use file extensions, so they are not a reliable indicator of the filetype.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/177cde5a7f2d95de6601f01e9bee8fdedf13a96b

commit 177cde5a7f2d95de6601f01e9bee8fdedf13a96b
Author: mortonm <mortonm@google.com>
Date: Mon Jun 26 23:41:34 2017

Rather than simply relying on file extension (e.g. .DMG) to determine whether to extract DMG features from download, instead look at file metadata to check for existence of 'koly' signature which identifies Mac archive types.

BUG= 600392 

>Review-Url: https://codereview.chromium.org/2926473002
>Cr-Commit-Position: refs/heads/master@{#480631}
>Committed: >https://chromium.googlesource.com/chromium/src/+/6602ea616cce79869b300ffa82c3fc64fe422200

Review-Url: https://codereview.chromium.org/2926473002
Cr-Commit-Position: refs/heads/master@{#482463}

[modify] https://crrev.com/177cde5a7f2d95de6601f01e9bee8fdedf13a96b/chrome/browser/safe_browsing/BUILD.gn
[add] https://crrev.com/177cde5a7f2d95de6601f01e9bee8fdedf13a96b/chrome/browser/safe_browsing/disk_image_type_sniffer_mac.cc
[add] https://crrev.com/177cde5a7f2d95de6601f01e9bee8fdedf13a96b/chrome/browser/safe_browsing/disk_image_type_sniffer_mac.h
[add] https://crrev.com/177cde5a7f2d95de6601f01e9bee8fdedf13a96b/chrome/browser/safe_browsing/disk_image_type_sniffer_mac_unittest.cc
[modify] https://crrev.com/177cde5a7f2d95de6601f01e9bee8fdedf13a96b/chrome/browser/safe_browsing/download_protection_service.cc
[modify] https://crrev.com/177cde5a7f2d95de6601f01e9bee8fdedf13a96b/chrome/browser/safe_browsing/download_protection_service_unittest.cc
[modify] https://crrev.com/177cde5a7f2d95de6601f01e9bee8fdedf13a96b/chrome/test/BUILD.gn
[modify] https://crrev.com/177cde5a7f2d95de6601f01e9bee8fdedf13a96b/chrome/test/data/safe_browsing/dmg/generate_test_data.sh
[modify] https://crrev.com/177cde5a7f2d95de6601f01e9bee8fdedf13a96b/tools/metrics/histograms/histograms.xml

Oops, closed by accident. Reopen this issue and assign to mortonm@

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/034ecb569929e1202f39cf744a32e8deeade06c8

commit 034ecb569929e1202f39cf744a32e8deeade06c8
Author: mortonm <mortonm@google.com>
Date: Fri Aug 04 14:57:41 2017

Improve Zip File Scanning on Mac

This CL fixes two aspects of broken ZIP processing on Mac. First, it ensures
that .app files are treated as directories and as such do not break binary
feature extraction, causing analysis to fail. Second, it performs
type-sniffing to identify the existence of executable MachO files that do not
have any file extension, as is the usual case on Mac.

BUG= 600392 

Review-Url: https://codereview.chromium.org/2961373002
Cr-Commit-Position: refs/heads/master@{#492032}

[modify] https://crrev.com/034ecb569929e1202f39cf744a32e8deeade06c8/chrome/browser/safe_browsing/sandboxed_zip_analyzer_unittest.cc
[modify] https://crrev.com/034ecb569929e1202f39cf744a32e8deeade06c8/chrome/common/safe_browsing/zip_analyzer.cc
[modify] https://crrev.com/034ecb569929e1202f39cf744a32e8deeade06c8/chrome/test/data/safe_browsing/mach_o/Makefile
[add] https://crrev.com/034ecb569929e1202f39cf744a32e8deeade06c8/chrome/test/data/safe_browsing/mach_o/zipped-app-two-executables-one-signed.zip
[modify] https://crrev.com/034ecb569929e1202f39cf744a32e8deeade06c8/third_party/zlib/google/zip_reader.cc
[modify] https://crrev.com/034ecb569929e1202f39cf744a32e8deeade06c8/third_party/zlib/google/zip_reader.h
[modify] https://crrev.com/034ecb569929e1202f39cf744a32e8deeade06c8/third_party/zlib/google/zip_reader_unittest.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0b415f14a94fd3e4c8ff5cad64779ecd3d2335cc

commit 0b415f14a94fd3e4c8ff5cad64779ecd3d2335cc
Author: Micah Morton <mortonm@google.com>
Date: Tue Aug 08 18:26:46 2017

Record UMA stat for whether Zip downloads on Mac contain .app.

.app directories on Mac need to be packaged into one file for
transmission. This is frequently done by archiving into .dmg file, but
can also be done by zipping into .zip.

Bug:  600392 
Change-Id: Ie7c137307ace593dde95bd7311bc32ed71bbc55b
Reviewed-on: https://chromium-review.googlesource.com/603881
Commit-Queue: Micah Morton <mortonm@google.com>
Reviewed-by: Jialiu Lin <jialiul@chromium.org>
Reviewed-by: Steven Holte <holte@chromium.org>
Cr-Commit-Position: refs/heads/master@{#492704}
[modify] https://crrev.com/0b415f14a94fd3e4c8ff5cad64779ecd3d2335cc/chrome/browser/safe_browsing/sandboxed_zip_analyzer_unittest.cc
[modify] https://crrev.com/0b415f14a94fd3e4c8ff5cad64779ecd3d2335cc/chrome/common/safe_browsing/zip_analyzer.cc
[modify] https://crrev.com/0b415f14a94fd3e4c8ff5cad64779ecd3d2335cc/tools/metrics/histograms/histograms.xml

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot