diff options
author | Jeff Sharkey <jsharkey@android.com> | 2013-09-25 14:43:11 -0700 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2013-09-25 14:43:11 -0700 |
commit | 5f09eb5a4a2542523041cc28d4d3562e0cadaead (patch) | |
tree | 5bc21ad85affbee7cbc315cd52bba9542fb86751 | |
parent | caf91f311e572ed52d7b82cad312a5e908ca91e2 (diff) | |
parent | 776e4f7991c4f5637f9a945ed9190a26ff295446 (diff) | |
download | android_packages_providers_DownloadProvider-5f09eb5a4a2542523041cc28d4d3562e0cadaead.tar.gz android_packages_providers_DownloadProvider-5f09eb5a4a2542523041cc28d4d3562e0cadaead.tar.bz2 android_packages_providers_DownloadProvider-5f09eb5a4a2542523041cc28d4d3562e0cadaead.zip |
am 776e4f79: Always check against canonical paths.
* commit '776e4f7991c4f5637f9a945ed9190a26ff295446':
Always check against canonical paths.
-rw-r--r-- | src/com/android/providers/downloads/Helpers.java | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/src/com/android/providers/downloads/Helpers.java b/src/com/android/providers/downloads/Helpers.java index aa763de2..013faf27 100644 --- a/src/com/android/providers/downloads/Helpers.java +++ b/src/com/android/providers/downloads/Helpers.java @@ -344,16 +344,26 @@ public class Helpers { * Checks whether the filename looks legitimate */ static boolean isFilenameValid(String filename, File downloadsDataDir) { + final String[] whitelist; try { filename = new File(filename).getCanonicalPath(); + whitelist = new String[] { + downloadsDataDir.getCanonicalPath(), + Environment.getDownloadCacheDirectory().getCanonicalPath(), + Environment.getExternalStorageDirectory().getCanonicalPath(), + }; } catch (IOException e) { Log.w(TAG, "Failed to resolve canonical path: " + e); return false; } - return filename.startsWith(Environment.getDownloadCacheDirectory().toString()) - || filename.startsWith(downloadsDataDir.toString()) - || filename.startsWith(Environment.getExternalStorageDirectory().toString()); + for (String test : whitelist) { + if (filename.startsWith(test)) { + return true; + } + } + + return false; } /** |