filab/packages_apps_Messaging
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Messenger refuses all file:///data/ uris

Browse Source 
We've been informed it's possible for an app to create a world
readable hardlink in L in its own /data directory that links to
another apps private data, including Messenger data. The hardlink
bypassed our existing checks. So now we simply refuse all file: uris
in the /data/ directory.
Other apps shouldn't be sending file uris anyway, and we dont know
of any that send file:///data/ uris.

Bug: 28793303
Change-Id: I778bb2bcb9e11185357093c59fc1fa3f6caa26a1
This commit is contained in:
Tavis Bohne
2016-05-17 17:36:51 -07:00
parent ca5fc9fa7d
commit 41f3b673f1
2 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java
View File

@@ -159,7 +159,7 @@ public class ShareIntentActivity extends BaseBugleActivity implements
}
private void addSharedImagePartToDraft(final String contentType, final Uri imageUri) {
if (FileUtil.isInPrivateDir(getBaseContext(), imageUri)) {
if (FileUtil.isInPrivateDir(imageUri)) {
Assert.fail("Cannot send private file " + imageUri.toString());
} else {
mDraftMessage.addPart(PendingAttachmentData.createPendingAttachmentData(contentType,

10
src/com/android/messaging/util/FileUtil.java
View File

@@ -19,6 +19,7 @@ package com.android.messaging.util;
import android.content.ContentResolver;
import android.content.Context;
import android.net.Uri;
import android.os.Environment;
import android.text.TextUtils;
import android.webkit.MimeTypeMap;
@@ -123,14 +124,15 @@ public class FileUtil {
return TextUtils.equals(uri.getScheme(), ContentResolver.SCHEME_FILE);
}
// Checks if the file is in /data/data/com.android.messaging
// The other app folders are either symlinks to this, or hold non-private data like binaries.
public static boolean isInPrivateDir(Context context, Uri uri) {
// Checks if the file is in /data, and don't allow any app to send personal information.
// We're told it's possible to create world readable hardlinks to other apps private data
// so we ban all /data file uris.
public static boolean isInPrivateDir(Uri uri) {
if (!isFileUri(uri)) {
return false;
}
final File file = new File(uri.getPath());
return FileUtil.isSameOrSubDirectory(new File(context.getApplicationInfo().dataDir), file);
return FileUtil.isSameOrSubDirectory(Environment.getDataDirectory(), file);
}
/**