From 0b258f030a589c83b8499d2f994c268bee92abba Mon Sep 17 00:00:00 2001 From: Jake Klinker Date: Tue, 11 Jan 2022 00:38:23 +0000 Subject: [PATCH] Fix isFileUri to recognize URIs with spaces. The underlying framework recognizes " file://..." as a valid URI and fetches the file, allowing for a possible exploit (see b/209965112). This trims the URI so that we can properly recognize it as a file from within our code. Bug: 209965112 Change-Id: I8d9d9100e9a8c3bd64d19015d2177a14ec2306f3 Test: See repro steps on http://b/209965112, was no longer able to repro. --- src/com/android/messaging/util/UriUtil.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/com/android/messaging/util/UriUtil.java b/src/com/android/messaging/util/UriUtil.java index 1d6a1be..6e39749 100644 --- a/src/com/android/messaging/util/UriUtil.java +++ b/src/com/android/messaging/util/UriUtil.java @@ -98,7 +98,7 @@ public class UriUtil { public static boolean isFileUri(final Uri uri) { return uri != null && uri.getScheme() != null && - TextUtils.equals(uri.getScheme().toLowerCase(), + TextUtils.equals(uri.getScheme().trim().toLowerCase(), ContentResolver.SCHEME_FILE); }