Fixes b/37629504 by not creating attachments from file URIs shared via
intent. Sharing file URIs is disallowed by Android N and later and is no
longer supported for this app.
Test: manual using the Debug command added in this change
Change-Id: Iaecff745aca76381d387ab057ffa1f2024aebfcf
* A security researcher crafted a gif that would cause the Android
Bitmap code to throw an NPE. That would cause messaging to crash when
decoding the NPE. Catch the NPE.
Test: manually tested the "crash.gif" attached to the bug. Stepped
through the debugger to verify we're catching the NPE and logging
the attempt. Verified normal gifs still work.
Bug: 37742976
Change-Id: Iab814d5b0b514bed0cecddd9a76f1fc095f90892
(cherry picked from commit 3671fd94ae)
attach private files from "/data/data/com.android.messaging/"
directory to the messaging app.
* This is a manual merge from ag/871758 -- backporting a security fix from
Bugle to Kazoo.
* Don't export the MediaScratchFileProvider or the MmsFileProvider. This
will block external access from third party apps. In addition, make both
providers more robust in handling path names. Make sure the file paths
handled in the providers point to the expected directory.
Change-Id: I9e6b3ae0e122e3f5022243418f2893d4a0859edb
Fixes: 32807795
in AOSP Messaging
* Check to make sure the returned uri from the gallery picker does
not point to bugle's data directory (or any subdir).
* Test:
Manual-
* I created the test app in the bug, the one that injects the bad
uri into Bugle. I verified the bad behavior before the fix and the
good behavior after.
* I tested the gallery to make sure picking photos,
from the photos app and drive, still work.
* I verified the behavior in the debugger to be sure the code is
catching the bad uri from the test app.
Change-Id: I3393f3b886c837a49758b91945cf1e17ec9bee41
Fixes: 32161610
For platforms with insecure handling of media files, media files should
be opened only after the user chooses to play the media.
Change-Id: I5f9bbd1f8468a704a5962f0dddd3c8b11bba8bea
