From 56bacbcb13093191748551c2cbdc4133ba60ec77 Mon Sep 17 00:00:00 2001 From: Jake Klinker Date: Wed, 6 Oct 2021 21:08:32 +0000 Subject: [PATCH 1/2] Convert URI scheme to lower case before checking if it is a file. This fixes an edge case where a "File://" style URI could be passed in but not pass this check, even though the underlying framework recognizes this as a legitimate file. Bug: 197328178 Test: See repro steps on http://b/197328178, was no longer able to repro. Change-Id: Id837744a79d1aca91b41d24207dc9b98f2b5b5e9 (cherry picked from commit 9607c95e7164e7856c45fd9d07eea9b09f9db681) --- src/com/android/messaging/util/UriUtil.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/com/android/messaging/util/UriUtil.java b/src/com/android/messaging/util/UriUtil.java index d336167..1d6a1be 100644 --- a/src/com/android/messaging/util/UriUtil.java +++ b/src/com/android/messaging/util/UriUtil.java @@ -94,8 +94,12 @@ public class UriUtil { return TextUtils.equals(scheme, ContentResolver.SCHEME_ANDROID_RESOURCE); } + /** Returns whether the given Uri is a file. */ public static boolean isFileUri(final Uri uri) { - return uri != null && TextUtils.equals(uri.getScheme(), ContentResolver.SCHEME_FILE); + return uri != null && + uri.getScheme() != null && + TextUtils.equals(uri.getScheme().toLowerCase(), + ContentResolver.SCHEME_FILE); } /** From 6e0ca5609517ce10485a1a44b6f43ec64ea16f3b Mon Sep 17 00:00:00 2001 From: Jake Klinker Date: Tue, 11 Jan 2022 00:38:23 +0000 Subject: [PATCH 2/2] Fix isFileUri to recognize URIs with spaces. The underlying framework recognizes " file://..." as a valid URI and fetches the file, allowing for a possible exploit (see b/209965112). This trims the URI so that we can properly recognize it as a file from within our code. Bug: 209965112 Change-Id: I8d9d9100e9a8c3bd64d19015d2177a14ec2306f3 Test: See repro steps on http://b/209965112, was no longer able to repro. --- src/com/android/messaging/util/UriUtil.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/com/android/messaging/util/UriUtil.java b/src/com/android/messaging/util/UriUtil.java index 1d6a1be..6e39749 100644 --- a/src/com/android/messaging/util/UriUtil.java +++ b/src/com/android/messaging/util/UriUtil.java @@ -98,7 +98,7 @@ public class UriUtil { public static boolean isFileUri(final Uri uri) { return uri != null && uri.getScheme() != null && - TextUtils.equals(uri.getScheme().toLowerCase(), + TextUtils.equals(uri.getScheme().trim().toLowerCase(), ContentResolver.SCHEME_FILE); }