From d195a5c677e575ba7e96e9366d0823c3c822231d Mon Sep 17 00:00:00 2001 From: Jeff Sharkey Date: Wed, 12 Oct 2011 12:04:10 -0700 Subject: Check canonical path when download requested. Bug: 5449870 Change-Id: I3219273be9b796b123545c811e5f39fa83b5768e --- src/com/android/providers/downloads/DownloadProvider.java | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/com/android/providers/downloads/DownloadProvider.java b/src/com/android/providers/downloads/DownloadProvider.java index 6b4420f8..02e5d587 100644 --- a/src/com/android/providers/downloads/DownloadProvider.java +++ b/src/com/android/providers/downloads/DownloadProvider.java @@ -44,6 +44,7 @@ import com.google.common.annotations.VisibleForTesting; import java.io.File; import java.io.FileNotFoundException; +import java.io.IOException; import java.util.ArrayList; import java.util.Arrays; import java.util.HashSet; @@ -673,13 +674,18 @@ public final class DownloadProvider extends ContentProvider { if (scheme == null || !scheme.equals("file")) { throw new IllegalArgumentException("Not a file URI: " + uri); } - String path = uri.getPath(); + final String path = uri.getPath(); if (path == null) { throw new IllegalArgumentException("Invalid file URI: " + uri); } - String externalPath = Environment.getExternalStorageDirectory().getAbsolutePath(); - if (!path.startsWith(externalPath)) { - throw new SecurityException("Destination must be on external storage: " + uri); + try { + final String canonicalPath = new File(path).getCanonicalPath(); + final String externalPath = Environment.getExternalStorageDirectory().getAbsolutePath(); + if (!canonicalPath.startsWith(externalPath)) { + throw new SecurityException("Destination must be on external storage: " + uri); + } + } catch (IOException e) { + throw new SecurityException("Problem resolving path: " + uri); } } -- cgit v1.2.3