Messenger refuses all file:///data/ uris
We've been informed it's possible for an app to create a world readable hardlink in L in its own /data directory that links to another apps private data, including Messenger data. The hardlink bypassed our existing checks. So now we simply refuse all file: uris in the /data/ directory. Other apps shouldn't be sending file uris anyway, and we dont know of any that send file:///data/ uris. Bug: 28793303 Change-Id: I778bb2bcb9e11185357093c59fc1fa3f6caa26a1
This commit is contained in:
@@ -159,7 +159,7 @@ public class ShareIntentActivity extends BaseBugleActivity implements
|
||||
}
|
||||
|
||||
private void addSharedImagePartToDraft(final String contentType, final Uri imageUri) {
|
||||
if (FileUtil.isInPrivateDir(getBaseContext(), imageUri)) {
|
||||
if (FileUtil.isInPrivateDir(imageUri)) {
|
||||
Assert.fail("Cannot send private file " + imageUri.toString());
|
||||
} else {
|
||||
mDraftMessage.addPart(PendingAttachmentData.createPendingAttachmentData(contentType,
|
||||
|
||||
Reference in New Issue
Block a user