diff options
| author | Jeff Sharkey <jsharkey@android.com> | 2016-01-07 14:15:59 -0700 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-03-01 15:26:56 -0800 |
| commit | 8ec005728d47e282d72801b4bb43c9a3ea8f717f (patch) | |
| tree | fe205687fc9d7a776d1f55b3d3e8ee823f1c0952 /src/com/android/providers/downloads/Helpers.java | |
| parent | 616188b0a0c96e88926e84cfe156908f0da9ebe2 (diff) | |
| download | android_packages_providers_DownloadProvider-8ec005728d47e282d72801b4bb43c9a3ea8f717f.tar.gz android_packages_providers_DownloadProvider-8ec005728d47e282d72801b4bb43c9a3ea8f717f.tar.bz2 android_packages_providers_DownloadProvider-8ec005728d47e282d72801b4bb43c9a3ea8f717f.zip | |
Use resolved path for both checking and opening.
This avoids a race condition where someone can change a symlink
target after the security checks have passed.
Bug: 26211054
Change-Id: I5842aaecc7b7d417a3b1902957b59b8a1f3c1ccb
Diffstat (limited to 'src/com/android/providers/downloads/Helpers.java')
| -rw-r--r-- | src/com/android/providers/downloads/Helpers.java | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/src/com/android/providers/downloads/Helpers.java b/src/com/android/providers/downloads/Helpers.java index d1cc5450..d01cbff2 100644 --- a/src/com/android/providers/downloads/Helpers.java +++ b/src/com/android/providers/downloads/Helpers.java @@ -357,8 +357,6 @@ public class Helpers { static boolean isFilenameValidInExternalPackage(Context context, File file, String packageName) { try { - file = file.getCanonicalFile(); - if (containsCanonical(buildExternalStorageAppFilesDirs(packageName), file) || containsCanonical(buildExternalStorageAppObbDirs(packageName), file) || containsCanonical(buildExternalStorageAppCacheDirs(packageName), file) || @@ -380,8 +378,6 @@ public class Helpers { */ static boolean isFilenameValid(Context context, File file, boolean allowInternal) { try { - file = file.getCanonicalFile(); - if (allowInternal) { if (containsCanonical(context.getFilesDir(), file) || containsCanonical(context.getCacheDir(), file) |