filab/packages_apps_Messaging
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge \"Messenger refuses all file:///data/ uris\" into nyc-dev

Browse Source 
am: 9de3ed279b

Change-Id: I767e29fcbf808a84354b15a511a65f0a4a8a04ae
This commit is contained in:
Tavis Bohne
2016-06-08 17:03:13 +00:00
committed by android-build-merger
parent 4e106215ed 9de3ed279b
commit f0a36952dc
2 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java
View File

@@ -159,7 +159,7 @@ public class ShareIntentActivity extends BaseBugleActivity implements
} }
private void addSharedImagePartToDraft(final String contentType, final Uri imageUri) { private void addSharedImagePartToDraft(final String contentType, final Uri imageUri) {
if (FileUtil.isInPrivateDir(getBaseContext(), imageUri)) { if (FileUtil.isInPrivateDir(imageUri)) {
Assert.fail("Cannot send private file " + imageUri.toString()); Assert.fail("Cannot send private file " + imageUri.toString());
} else { } else {
mDraftMessage.addPart(PendingAttachmentData.createPendingAttachmentData(contentType, mDraftMessage.addPart(PendingAttachmentData.createPendingAttachmentData(contentType,

10
src/com/android/messaging/util/FileUtil.java
View File

@@ -19,6 +19,7 @@ package com.android.messaging.util;
import android.content.ContentResolver; import android.content.ContentResolver;
import android.content.Context; import android.content.Context;
import android.net.Uri; import android.net.Uri;
import android.os.Environment;
import android.text.TextUtils; import android.text.TextUtils;
import android.webkit.MimeTypeMap; import android.webkit.MimeTypeMap;
@@ -123,14 +124,15 @@ public class FileUtil {
return TextUtils.equals(uri.getScheme(), ContentResolver.SCHEME_FILE); return TextUtils.equals(uri.getScheme(), ContentResolver.SCHEME_FILE);
} }
// Checks if the file is in /data/data/com.android.messaging // Checks if the file is in /data, and don't allow any app to send personal information.
// The other app folders are either symlinks to this, or hold non-private data like binaries. // We're told it's possible to create world readable hardlinks to other apps private data
public static boolean isInPrivateDir(Context context, Uri uri) { // so we ban all /data file uris.
public static boolean isInPrivateDir(Uri uri) {
if (!isFileUri(uri)) { if (!isFileUri(uri)) {
return false; return false;
} }
final File file = new File(uri.getPath()); final File file = new File(uri.getPath());
return FileUtil.isSameOrSubDirectory(new File(context.getApplicationInfo().dataDir), file); return FileUtil.isSameOrSubDirectory(Environment.getDataDirectory(), file);
} }
/** /**