Messenger refuses all file:///data/ uris

We've been informed it's possible for an app to create a world
readable hardlink in L in its own /data directory that links to
another apps private data, including Messenger data. The hardlink
bypassed our existing checks. So now we simply refuse all file: uris
in the /data/ directory.
Other apps shouldn't be sending file uris anyway, and we dont know
of any that send file:///data/ uris.

Bug: 28793303
Change-Id: I778bb2bcb9e11185357093c59fc1fa3f6caa26a1
This commit is contained in:
Tavis Bohne
2016-05-17 17:36:51 -07:00
parent ca5fc9fa7d
commit 41f3b673f1
2 changed files with 7 additions and 5 deletions
@@ -159,7 +159,7 @@ public class ShareIntentActivity extends BaseBugleActivity implements
}
private void addSharedImagePartToDraft(final String contentType, final Uri imageUri) {
if (FileUtil.isInPrivateDir(getBaseContext(), imageUri)) {
if (FileUtil.isInPrivateDir(imageUri)) {
Assert.fail("Cannot send private file " + imageUri.toString());
} else {
mDraftMessage.addPart(PendingAttachmentData.createPendingAttachmentData(contentType,