filab/packages_apps_Messaging
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

32807795 Security Vulnerability - AOSP Messaging App: thirdparty can attach private files from "/data/data/com.android.messaging/" directory to the messaging app. am: a2aa53f83a am: 90bf70396d am: 305a004e19 am: 2397f2fbef am: 313284eee7 am: 4dfcff98da am: 615f6d0b17

Browse Source 
am: 49b092f602

Change-Id: Ibab72017d2b4f54a77b8ff4030587a05e29b43b8
This commit is contained in:
Tom Taylor
2016-12-06 22:39:38 +00:00
committed by android-build-merger
parent 255c296b3b 49b092f602
commit a9bec8503b
3 changed files with 39 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
AndroidManifest.xml
View File

@@ -317,11 +317,13 @@
<provider android:name=".datamodel.MmsFileProvider"
android:authorities="com.android.messaging.datamodel.MmsFileProvider"
android:grantUriPermissions="true" />
android:grantUriPermissions="true"
android:exported="false" />
<provider android:name=".datamodel.MediaScratchFileProvider"
android:authorities="com.android.messaging.datamodel.MediaScratchFileProvider"
android:grantUriPermissions="true" />
android:grantUriPermissions="true"
android:exported="false" />
<!-- Action Services -->

18
src/com/android/messaging/datamodel/MediaScratchFileProvider.java
View File

@@ -32,6 +32,7 @@ import com.android.messaging.util.LogUtil;
import com.google.common.annotations.VisibleForTesting;
import java.io.File;
import java.io.IOException;
import java.util.List;
/**
@@ -89,8 +90,23 @@ public class MediaScratchFileProvider extends FileProvider {
private static File getFileWithExtension(final String path, final String extension) {
final Context context = Factory.get().getApplicationContext();
return new File(getDirectory(context),
final File filePath = new File(getDirectory(context),
TextUtils.isEmpty(extension) ? path : path + "." + extension);
try {
if (!filePath.getCanonicalPath()
.startsWith(getDirectory(context).getCanonicalPath())) {
LogUtil.e(TAG, "getFileWithExtension: path "
+ filePath.getCanonicalPath()
+ " does not start with "
+ getDirectory(context).getCanonicalPath());
return null;
}
} catch (IOException e) {
LogUtil.e(TAG, "getFileWithExtension: getCanonicalPath failed ", e);
return null;
}
return filePath;
}
private static File getDirectory(final Context context) {

19
src/com/android/messaging/datamodel/MmsFileProvider.java
View File

@@ -18,12 +18,14 @@ package com.android.messaging.datamodel;
import android.content.Context;
import android.net.Uri;
import android.text.TextUtils;
import com.android.messaging.Factory;
import com.android.messaging.util.LogUtil;
import com.google.common.annotations.VisibleForTesting;
import java.io.File;
import java.io.IOException;
/**
* A very simple content provider that can serve mms files from our cache directory.
@@ -60,7 +62,22 @@ public class MmsFileProvider extends FileProvider {
private static File getFile(final String path) {
final Context context = Factory.get().getApplicationContext();
return new File(getDirectory(context), path + ".dat");
final File filePath = new File(getDirectory(context), path + ".dat");
try {
if (!filePath.getCanonicalPath()
.startsWith(getDirectory(context).getCanonicalPath())) {
LogUtil.e(TAG, "getFile: path "
+ filePath.getCanonicalPath()
+ " does not start with "
+ getDirectory(context).getCanonicalPath());
return null;
}
} catch (IOException e) {
LogUtil.e(TAG, "getFile: getCanonicalPath failed ", e);
return null;
}
return filePath;
}
private static File getDirectory(final Context context) {