summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJeff Sharkey <jsharkey@android.com>2016-02-16 23:08:21 (GMT)
committerThe Android Automerger <android-build@google.com>2016-02-27 00:56:20 (GMT)
commitff562d068d5a3a41999aada06ed46994d8f6efb4 (patch)
tree1271d0a2d3c5754202130cf4880098dbcb3a2414
parenta9216759e8a88e249183d17e311d2a652e5b35ce (diff)
downloadandroid_packages_providers_DownloadProvider-ff562d068d5a3a41999aada06ed46994d8f6efb4.zip
android_packages_providers_DownloadProvider-ff562d068d5a3a41999aada06ed46994d8f6efb4.tar.gz
android_packages_providers_DownloadProvider-ff562d068d5a3a41999aada06ed46994d8f6efb4.tar.bz2
DO NOT MERGE. Use resolved path when inserting and deleting.
This avoids a race condition where someone can change a symlink target after the security checks have passed. Bug: 26211054 Change-Id: Ia58425ab71c1472dd2f2dd31dae000ca29d0bcb2
-rw-r--r--src/com/android/providers/downloads/DownloadProvider.java20
1 files changed, 15 insertions, 5 deletions
diff --git a/src/com/android/providers/downloads/DownloadProvider.java b/src/com/android/providers/downloads/DownloadProvider.java
index 620085f..d9acc78 100644
--- a/src/com/android/providers/downloads/DownloadProvider.java
+++ b/src/com/android/providers/downloads/DownloadProvider.java
@@ -715,7 +715,13 @@ public final class DownloadProvider extends ContentProvider {
throw new IllegalArgumentException("Invalid file URI: " + uri);
}
- final File file = new File(path);
+ final File file;
+ try {
+ file = new File(path).getCanonicalFile();
+ } catch (IOException e) {
+ throw new SecurityException(e);
+ }
+
if (Helpers.isFilenameValidInExternalPackage(getContext(), file, getCallingPackage())) {
// No permissions required for paths belonging to calling package
return;
@@ -1191,10 +1197,14 @@ public final class DownloadProvider extends ContentProvider {
final String path = cursor.getString(1);
if (!TextUtils.isEmpty(path)) {
- final File file = new File(path);
- if (Helpers.isFilenameValid(getContext(), file)) {
- Log.v(Constants.TAG, "Deleting " + file + " via provider delete");
- file.delete();
+ try {
+ final File file = new File(path).getCanonicalFile();
+ if (Helpers.isFilenameValid(getContext(), file)) {
+ Log.v(Constants.TAG,
+ "Deleting " + file + " via provider delete");
+ file.delete();
+ }
+ } catch (IOException ignored) {
}
}
}