From f1b8f9a226c2b7664973622008ad860a0f8a7c37 Mon Sep 17 00:00:00 2001 From: Jake Klinker Date: Mon, 8 May 2023 23:07:07 +0000 Subject: [PATCH 1/4] Fix exposing private messages files through attachments with a content URI. Change-Id: I30b2a06c67af4a347d03c7504d13b9b9365acafd Tested: Was no longer able to repro b/275552292. Bug: 275552292 --- src/com/android/messaging/util/FileUtil.java | 25 ++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/src/com/android/messaging/util/FileUtil.java b/src/com/android/messaging/util/FileUtil.java index 71fbb4b..e7d86f2 100644 --- a/src/com/android/messaging/util/FileUtil.java +++ b/src/com/android/messaging/util/FileUtil.java @@ -20,6 +20,7 @@ import android.content.ContentResolver; import android.content.Context; import android.net.Uri; import android.os.Environment; +import android.os.ParcelFileDescriptor; import android.text.TextUtils; import com.android.messaging.Factory; @@ -28,6 +29,8 @@ import com.google.common.io.Files; import java.io.File; import java.io.IOException; +import java.nio.file.Path; +import java.nio.file.Paths; import java.text.SimpleDateFormat; import java.util.Date; import java.util.Locale; @@ -121,6 +124,10 @@ public class FileUtil { // We're told it's possible to create world readable hardlinks to other apps private data // so we ban all /data file uris. public static boolean isInPrivateDir(Uri uri) { + return isFileUriInPrivateDir(uri) || isContentUriInPrivateDir(uri); + } + + private static boolean isFileUriInPrivateDir(Uri uri) { if (!UriUtil.isFileUri(uri)) { return false; } @@ -128,6 +135,24 @@ public class FileUtil { return FileUtil.isSameOrSubDirectory(Environment.getDataDirectory(), file); } + private static boolean isContentUriInPrivateDir(Uri uri) { + if (!uri.getScheme().equals(ContentResolver.SCHEME_CONTENT)) { + return false; + } + try { + Context context = Factory.get().getApplicationContext(); + ParcelFileDescriptor pfd = context.getContentResolver().openFileDescriptor(uri, "r"); + int fd = pfd.getFd(); + // Use the file descriptor to find out the read file path through symbolic link. + Path fdPath = Paths.get("/proc/self/fd/" + fd); + Path filePath = java.nio.file.Files.readSymbolicLink(fdPath); + pfd.close(); + return FileUtil.isSameOrSubDirectory(Environment.getDataDirectory(), filePath.toFile()); + } catch (Exception e) { + return false; + } + } + /** * Checks, whether the child directory is the same as, or a sub-directory of the base * directory. From 4b16af13f77f6172d9645c9186978f9bb7da0c20 Mon Sep 17 00:00:00 2001 From: Jake Klinker Date: Thu, 11 May 2023 21:32:48 +0000 Subject: [PATCH 2/4] Trim recipient addresses that are unreasonably long. This ensures that bad input does not affect the db - the fallback is a reasonable one where we just launch the new conversation screen and have the user select the recipient. TESTED=manually confirmed that I could no longer repro b/278556945 after this change. BUG=278556945 Change-Id: I705a304a92cb46b20d916c6f5c2db81e6fa84f06 --- .../LaunchConversationActivity.java | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/com/android/messaging/ui/conversation/LaunchConversationActivity.java b/src/com/android/messaging/ui/conversation/LaunchConversationActivity.java index 5500ae8..c869839 100644 --- a/src/com/android/messaging/ui/conversation/LaunchConversationActivity.java +++ b/src/com/android/messaging/ui/conversation/LaunchConversationActivity.java @@ -37,6 +37,8 @@ import com.android.messaging.util.UriUtil; import java.io.UnsupportedEncodingException; import java.net.URLDecoder; +import java.util.ArrayList; +import java.util.List; /** * Launches ConversationActivity for sending a message to, or viewing messages from, a specific @@ -46,6 +48,7 @@ import java.net.URLDecoder; */ public class LaunchConversationActivity extends Activity implements LaunchConversationData.LaunchConversationDataListener { + private static final int MAX_RECIPIENT_LENGTH = 100; static final String SMS_BODY = "sms_body"; static final String ADDRESS = "address"; final Binding mBinding = BindingBase.createBinding(this); @@ -76,6 +79,9 @@ public class LaunchConversationActivity extends Activity implements recipients = new String[] { intent.getStringExtra(Intent.EXTRA_EMAIL) }; } } + if (recipients != null) { + recipients = trimInvalidRecipients(recipients); + } mSmsBody = intent.getStringExtra(SMS_BODY); if (TextUtils.isEmpty(mSmsBody)) { // Used by intents sent from the web YouTube (and perhaps others). @@ -103,6 +109,20 @@ public class LaunchConversationActivity extends Activity implements finish(); } + private String[] trimInvalidRecipients(String[] recipients) { + List trimmedRecipients = new ArrayList<>(); + for (String recipient : recipients) { + if (recipient.length() < MAX_RECIPIENT_LENGTH) { + trimmedRecipients.add(recipient); + } + } + if (trimmedRecipients.size() > 0) { + return trimmedRecipients.toArray(new String[0]); + } else { + return null; + } + } + private String getBody(final Uri uri) { if (uri == null) { return null; From a53cd33778175b64fecf642f9c1f7fd575312b44 Mon Sep 17 00:00:00 2001 From: Colin Cross Date: Tue, 17 Oct 2023 16:12:15 -0700 Subject: [PATCH 3/4] Fix Messaging for use_resource_processor: true Reference resources using the package name of the library that includes them. Bug: 294256649 Test: m javac-check Change-Id: I8fa72ec452ce6a7f8101022fbb35b3fc89073952 --- .../ui/contact/ContactRecipientAutoCompleteView.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/com/android/messaging/ui/contact/ContactRecipientAutoCompleteView.java b/src/com/android/messaging/ui/contact/ContactRecipientAutoCompleteView.java index 35641b2..17128c1 100644 --- a/src/com/android/messaging/ui/contact/ContactRecipientAutoCompleteView.java +++ b/src/com/android/messaging/ui/contact/ContactRecipientAutoCompleteView.java @@ -19,7 +19,6 @@ import android.content.Context; import android.database.Cursor; import android.graphics.Rect; import android.os.AsyncTask; -import androidx.appcompat.R; import android.text.Editable; import android.text.TextPaint; import android.text.TextWatcher; @@ -33,6 +32,7 @@ import android.widget.TextView; import com.android.ex.chips.RecipientEditTextView; import com.android.ex.chips.RecipientEntry; import com.android.ex.chips.recipientchip.DrawableRecipientChip; +import com.android.messaging.R; import com.android.messaging.datamodel.data.ParticipantData; import com.android.messaging.util.ContactRecipientEntryUtils; import com.android.messaging.util.ContactUtil; @@ -114,7 +114,7 @@ public class ContactRecipientAutoCompleteView extends RecipientEditTextView { setOnFocusListShrinkRecipients(false); setBackground(context.getResources().getDrawable( - R.drawable.abc_textfield_search_default_mtrl_alpha)); + androidx.appcompat.R.drawable.abc_textfield_search_default_mtrl_alpha)); } public void setContactChipsListener(final ContactChipsChangeListener listener) { From 3586032a9be4d31dc2905be29210ba5e313b0614 Mon Sep 17 00:00:00 2001 From: Sooraj Sasindran Date: Wed, 25 Oct 2023 15:04:46 -0700 Subject: [PATCH 4/4] Fix the syntax issues in fill sms script Bug: 307587226 Test: ran manually and verified that db is updated Change-Id: I02e57588433b5ff1e4d2208c172b904deb8d8236 --- tools/messagegen/fillsms | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) mode change 100755 => 100644 tools/messagegen/fillsms diff --git a/tools/messagegen/fillsms b/tools/messagegen/fillsms old mode 100755 new mode 100644 index 6903941..dc2e507 --- a/tools/messagegen/fillsms +++ b/tools/messagegen/fillsms @@ -100,9 +100,11 @@ image_list_file=$1 shift sql_file=$1 shift +echo $image_list_file dict_lines=`wc -l < $DICT` image_files=`wc -l < $image_list_file` +echo $image_files if [ $mms_per_thread -gt "0" ]; then if [ ! -f $image_list_file ]; then @@ -123,7 +125,7 @@ random_value () dict_word () { - local v=$(random_value 30000) + local v=$(random_value $dict_lines) sed $v"q;d" $DICT } @@ -156,6 +158,11 @@ adb_sql () adb shell sqlite3 data/data/com.android.providers.telephony/databases/mmssms.db "$1" } +adb_sql_with_quotes () +{ + echo $1 + adb shell "sqlite3 data/data/com.android.providers.telephony/databases/mmssms.db \"$1\"" +} ###################################################################################### ###################################################################################### @@ -163,6 +170,7 @@ if [ $opt_exec_only -eq "0" ]; then # clean up sql file rm -f $sql_file + add_sql "PRAGMA trusted_schema=1;" # add sql to clean up database add_sql "delete from pdu where _id>=$TABLE_SMS_START_ID;" add_sql "delete from part where _id>=$TABLE_SMS_START_ID;" @@ -197,6 +205,7 @@ if [ $opt_exec_only -eq "0" ]; then # Generate SMS if [ $sms_per_thread -gt "0" ]; then + add_sql "PRAGMA trusted_schema=1;" half_timestamp_inc=$(( 500 + ((($sms_per_thread + $mms_per_thread) * $TIMESTAMP_INC_IN_SECONDS) * 500 / $sms_per_thread) )) for j in `seq 1 $sms_per_thread`; do @@ -268,20 +277,22 @@ if [ $opt_sql_only -eq "0" ]; then echo adb_sql ".read /data/fillsms" echo - adb_sql "select count(*) from canonical_addresses where _id>=$TABLE_CANONICAL_ADDRESSES_START_ID;" + add_sql "PRAGMA trusted_schema=1;" echo - adb_sql "select count(*) from threads where _id>=$TABLE_THREADS_START_ID;" + adb_sql_with_quotes "select count(*) from canonical_addresses where _id>=$TABLE_CANONICAL_ADDRESSES_START_ID;" + echo + adb_sql_with_quotes "select count(*) from threads where _id>=$TABLE_THREADS_START_ID;" echo if [ $sms_per_thread -gt "0" ]; then - adb_sql "select count(*) from sms where _id>=$TABLE_SMS_START_ID;" + adb_sql_with_quotes "select count(*) from sms where _id>=$TABLE_SMS_START_ID;" echo fi if [ $mms_per_thread -gt "0" ]; then - adb_sql "select count(*) from pdu where _id>=$TABLE_SMS_START_ID;" + adb_sql_with_quotes "select count(*) from pdu where _id>=$TABLE_SMS_START_ID;" echo - adb_sql "select count(*) from part where _id>=$TABLE_SMS_START_ID;" + adb_sql_with_quotes "select count(*) from part where _id>=$TABLE_SMS_START_ID;" echo - adb_sql "select count(*) from addr where _id>=$TABLE_SMS_START_ID;" + adb_sql_with_quotes "select count(*) from addr where _id>=$TABLE_SMS_START_ID;" echo fi fi