Messaging doesn't allow sharing of its own files
-Previously, Messaging allowed sharing of any file it had permission to reach. This meant that bad apps could share a link to file:///data/data/com.android.messaging/databases/bugle_db and Messaging would happily send all this sensitive information to the target. Worse, a bad app could share a softlink to this file, where the symlink was picture.jpg with the image/jpg type. -Now, when sanitizing attachments, we make sure any filepaths don't lead to any Bugle-specific directories. -getApplicationInfo().dataDir is a symlink to /data/data/com.android.messaging, and appears to be the only directory where we store personal data. -Most apps share as contentUris, including Messaging, so Messaging can still share to itself. Change-Id: Ic464bc1f099029a030793c478aaf88b957d8bad1 Fixes:28076752
This commit is contained in:
@@ -16,7 +16,10 @@
|
||||
|
||||
package com.android.messaging.util;
|
||||
|
||||
import android.content.ContentResolver;
|
||||
import android.content.Context;
|
||||
import android.net.Uri;
|
||||
import android.text.TextUtils;
|
||||
import android.webkit.MimeTypeMap;
|
||||
|
||||
import com.android.messaging.Factory;
|
||||
@@ -116,6 +119,20 @@ public class FileUtil {
|
||||
}
|
||||
}
|
||||
|
||||
private static boolean isFileUri(final Uri uri) {
|
||||
return TextUtils.equals(uri.getScheme(), ContentResolver.SCHEME_FILE);
|
||||
}
|
||||
|
||||
// Checks if the file is in /data/data/com.android.messaging
|
||||
// The other app folders are either symlinks to this, or hold non-private data like binaries.
|
||||
public static boolean isInPrivateDir(Context context, Uri uri) {
|
||||
if (!isFileUri(uri)) {
|
||||
return false;
|
||||
}
|
||||
final File file = new File(uri.getPath());
|
||||
return FileUtil.isSameOrSubDirectory(new File(context.getApplicationInfo().dataDir), file);
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks, whether the child directory is the same as, or a sub-directory of the base
|
||||
* directory.
|
||||
|
||||
Reference in New Issue
Block a user