Fix isFileUri to recognize URIs with spaces.
The underlying framework recognizes " file://..." as a valid URI and fetches the file, allowing for a possible exploit (see b/209965112). This trims the URI so that we can properly recognize it as a file from within our code. Bug: 209965112 Change-Id: I8d9d9100e9a8c3bd64d19015d2177a14ec2306f3 Test: See repro steps on http://b/209965112, was no longer able to repro.
This commit is contained in:
@@ -98,7 +98,7 @@ public class UriUtil {
|
||||
public static boolean isFileUri(final Uri uri) {
|
||||
return uri != null &&
|
||||
uri.getScheme() != null &&
|
||||
TextUtils.equals(uri.getScheme().toLowerCase(),
|
||||
TextUtils.equals(uri.getScheme().trim().toLowerCase(),
|
||||
ContentResolver.SCHEME_FILE);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user