From 41f3b673f1f4b4071ef1af180a6397e1318885d3 Mon Sep 17 00:00:00 2001
From: Tavis Bohne <tbohne@google.com>
Date: Tue, 17 May 2016 17:36:51 -0700
Subject: [PATCH] Messenger refuses all file:///data/ uris

We've been informed it's possible for an app to create a world
readable hardlink in L in its own /data directory that links to
another apps private data, including Messenger data. The hardlink
bypassed our existing checks. So now we simply refuse all file: uris
in the /data/ directory.
Other apps shouldn't be sending file uris anyway, and we dont know
of any that send file:///data/ uris.

Bug: 28793303
Change-Id: I778bb2bcb9e11185357093c59fc1fa3f6caa26a1
---
 .../ui/conversationlist/ShareIntentActivity.java       |  2 +-
 src/com/android/messaging/util/FileUtil.java           | 10 ++++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java b/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java
index 396f1da..83b7be9 100644
--- a/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java
+++ b/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java
@@ -159,7 +159,7 @@ public class ShareIntentActivity extends BaseBugleActivity implements
     }
 
     private void addSharedImagePartToDraft(final String contentType, final Uri imageUri) {
-        if (FileUtil.isInPrivateDir(getBaseContext(), imageUri)) {
+        if (FileUtil.isInPrivateDir(imageUri)) {
             Assert.fail("Cannot send private file " + imageUri.toString());
         } else {
             mDraftMessage.addPart(PendingAttachmentData.createPendingAttachmentData(contentType,
diff --git a/src/com/android/messaging/util/FileUtil.java b/src/com/android/messaging/util/FileUtil.java
index f8051ed..e35e79b 100644
--- a/src/com/android/messaging/util/FileUtil.java
+++ b/src/com/android/messaging/util/FileUtil.java
@@ -19,6 +19,7 @@ package com.android.messaging.util;
 import android.content.ContentResolver;
 import android.content.Context;
 import android.net.Uri;
+import android.os.Environment;
 import android.text.TextUtils;
 import android.webkit.MimeTypeMap;
 
@@ -123,14 +124,15 @@ public class FileUtil {
         return TextUtils.equals(uri.getScheme(), ContentResolver.SCHEME_FILE);
     }
 
-    // Checks if the file is in /data/data/com.android.messaging
-    // The other app folders are either symlinks to this, or hold non-private data like binaries.
-    public static boolean isInPrivateDir(Context context, Uri uri) {
+    // Checks if the file is in /data, and don't allow any app to send personal information.
+    // We're told it's possible to create world readable hardlinks to other apps private data
+    // so we ban all /data file uris.
+    public static boolean isInPrivateDir(Uri uri) {
         if (!isFileUri(uri)) {
             return false;
         }
         final File file = new File(uri.getPath());
-        return FileUtil.isSameOrSubDirectory(new File(context.getApplicationInfo().dataDir), file);
+        return FileUtil.isSameOrSubDirectory(Environment.getDataDirectory(), file);
     }
 
     /**