diff options
author | Tavis Bohne <tbohne@google.com> | 2016-05-17 17:36:51 -0700 |
---|---|---|
committer | Tavis Bohne <tbohne@google.com> | 2016-05-17 17:36:51 -0700 |
commit | 41f3b673f1f4b4071ef1af180a6397e1318885d3 (patch) | |
tree | 5f1a9dd61064a16b01607b0ef212f617fc4f96a6 | |
parent | ca5fc9fa7dbba6cbab625d4a80f812b7206f0676 (diff) | |
download | android_packages_apps_Messaging-41f3b673f1f4b4071ef1af180a6397e1318885d3.tar.gz android_packages_apps_Messaging-41f3b673f1f4b4071ef1af180a6397e1318885d3.tar.bz2 android_packages_apps_Messaging-41f3b673f1f4b4071ef1af180a6397e1318885d3.zip |
Messenger refuses all file:///data/ uris
We've been informed it's possible for an app to create a world
readable hardlink in L in its own /data directory that links to
another apps private data, including Messenger data. The hardlink
bypassed our existing checks. So now we simply refuse all file: uris
in the /data/ directory.
Other apps shouldn't be sending file uris anyway, and we dont know
of any that send file:///data/ uris.
Bug: 28793303
Change-Id: I778bb2bcb9e11185357093c59fc1fa3f6caa26a1
-rw-r--r-- | src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java | 2 | ||||
-rw-r--r-- | src/com/android/messaging/util/FileUtil.java | 10 |
2 files changed, 7 insertions, 5 deletions
diff --git a/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java b/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java index 396f1da..83b7be9 100644 --- a/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java +++ b/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java @@ -159,7 +159,7 @@ public class ShareIntentActivity extends BaseBugleActivity implements } private void addSharedImagePartToDraft(final String contentType, final Uri imageUri) { - if (FileUtil.isInPrivateDir(getBaseContext(), imageUri)) { + if (FileUtil.isInPrivateDir(imageUri)) { Assert.fail("Cannot send private file " + imageUri.toString()); } else { mDraftMessage.addPart(PendingAttachmentData.createPendingAttachmentData(contentType, diff --git a/src/com/android/messaging/util/FileUtil.java b/src/com/android/messaging/util/FileUtil.java index f8051ed..e35e79b 100644 --- a/src/com/android/messaging/util/FileUtil.java +++ b/src/com/android/messaging/util/FileUtil.java @@ -19,6 +19,7 @@ package com.android.messaging.util; import android.content.ContentResolver; import android.content.Context; import android.net.Uri; +import android.os.Environment; import android.text.TextUtils; import android.webkit.MimeTypeMap; @@ -123,14 +124,15 @@ public class FileUtil { return TextUtils.equals(uri.getScheme(), ContentResolver.SCHEME_FILE); } - // Checks if the file is in /data/data/com.android.messaging - // The other app folders are either symlinks to this, or hold non-private data like binaries. - public static boolean isInPrivateDir(Context context, Uri uri) { + // Checks if the file is in /data, and don't allow any app to send personal information. + // We're told it's possible to create world readable hardlinks to other apps private data + // so we ban all /data file uris. + public static boolean isInPrivateDir(Uri uri) { if (!isFileUri(uri)) { return false; } final File file = new File(uri.getPath()); - return FileUtil.isSameOrSubDirectory(new File(context.getApplicationInfo().dataDir), file); + return FileUtil.isSameOrSubDirectory(Environment.getDataDirectory(), file); } /** |