diff options
author | Brad Ebinger <breadley@google.com> | 2016-10-10 18:47:56 +0000 |
---|---|---|
committer | android-build-merger <android-build-merger@google.com> | 2016-10-10 18:47:56 +0000 |
commit | c70cf1f8179be4eee95dd79cfcdb09b955a632f6 (patch) | |
tree | df3d33aaf446fd3fe011558807b028a6b057fdfa /sip | |
parent | 20a7668957d331fe1c3cf6555e3ed66e09fb6286 (diff) | |
parent | 072cd2c17058626e9b44c939ae760fcb97b64f8a (diff) | |
download | android_packages_services_Telephony-c70cf1f8179be4eee95dd79cfcdb09b955a632f6.tar.gz android_packages_services_Telephony-c70cf1f8179be4eee95dd79cfcdb09b955a632f6.tar.bz2 android_packages_services_Telephony-c70cf1f8179be4eee95dd79cfcdb09b955a632f6.zip |
Restrict SipProfiles to profiles directory am: 4c761b96c2 am: 2990d9f068 am: 90aca30c66
am: 072cd2c170
Change-Id: I2a6c40f5db91300bde79902759a2f610783b8add
Diffstat (limited to 'sip')
-rw-r--r-- | sip/src/com/android/services/telephony/sip/SipEditor.java | 2 | ||||
-rw-r--r-- | sip/src/com/android/services/telephony/sip/SipProfileDb.java | 29 |
2 files changed, 27 insertions, 4 deletions
diff --git a/sip/src/com/android/services/telephony/sip/SipEditor.java b/sip/src/com/android/services/telephony/sip/SipEditor.java index 8bc7734de..1cee25b24 100644 --- a/sip/src/com/android/services/telephony/sip/SipEditor.java +++ b/sip/src/com/android/services/telephony/sip/SipEditor.java @@ -258,7 +258,7 @@ public class SipEditor extends PreferenceActivity * * @param p The {@link SipProfile} to delete. */ - private void deleteAndUnregisterProfile(SipProfile p) { + private void deleteAndUnregisterProfile(SipProfile p) throws IOException { if (p == null) return; mProfileDb.deleteProfile(p); mSipAccountRegistry.stopSipService(this, p.getProfileName()); diff --git a/sip/src/com/android/services/telephony/sip/SipProfileDb.java b/sip/src/com/android/services/telephony/sip/SipProfileDb.java index e7b201b25..bb1c7ecd3 100644 --- a/sip/src/com/android/services/telephony/sip/SipProfileDb.java +++ b/sip/src/com/android/services/telephony/sip/SipProfileDb.java @@ -21,6 +21,7 @@ import com.android.internal.os.AtomicFile; import android.content.Context; import android.net.sip.SipProfile; import android.text.TextUtils; +import android.util.EventLog; import android.util.Log; import java.io.File; @@ -66,9 +67,13 @@ class SipProfileDb { mSipPreferences = new SipPreferences(mContext); } - public void deleteProfile(SipProfile p) { + public void deleteProfile(SipProfile p) throws IOException { synchronized(SipProfileDb.class) { - deleteProfile(new File(mProfilesDirectory + p.getProfileName())); + File profileFile = new File(mProfilesDirectory, p.getProfileName()); + if (!isChild(new File(mProfilesDirectory), profileFile)) { + throw new IOException("Invalid Profile Credentials!"); + } + deleteProfile(profileFile); if (mProfilesCount < 0) retrieveSipProfileListInternal(); } } @@ -93,7 +98,10 @@ class SipProfileDb { public void saveProfile(SipProfile p) throws IOException { synchronized(SipProfileDb.class) { if (mProfilesCount < 0) retrieveSipProfileListInternal(); - File f = new File(mProfilesDirectory + p.getProfileName()); + File f = new File(mProfilesDirectory, p.getProfileName()); + if (!isChild(new File(mProfilesDirectory), f)) { + throw new IOException("Invalid Profile Credentials!"); + } if (!f.exists()) f.mkdirs(); AtomicFile atomicFile = new AtomicFile(new File(f, PROFILE_OBJ_FILE)); FileOutputStream fos = null; @@ -173,4 +181,19 @@ class SipProfileDb { private static void log(String msg) { Log.d(SipUtil.LOG_TAG, PREFIX + msg); } + + /** + * Verifies that the file is a direct child of the base directory. + */ + private boolean isChild(File base, File file) { + if (base == null || file == null) { + return false; + } + if (!base.equals(file.getAbsoluteFile().getParentFile())) { + Log.w(SipUtil.LOG_TAG, "isChild, file is not a child of the base dir."); + EventLog.writeEvent(0x534e4554, "31530456", -1, ""); + return false; + } + return true; + } } |