diff options
| author | Gary Mai <garymai@google.com> | 2018-09-05 15:17:41 -0700 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2019-02-02 21:51:31 +0100 |
| commit | 52851972282d45af9514a8c46e226216292a9b5d (patch) | |
| tree | f4dd6d0b758e0d723c550c9e3cbc32e9f3cf9ac6 /MODULE_LICENSE_APACHE2 | |
| parent | 6a2c65b96c508637e3326dfefd33e8ec287052a2 (diff) | |
| download | packages_apps_Contacts-52851972282d45af9514a8c46e226216292a9b5d.tar.gz packages_apps_Contacts-52851972282d45af9514a8c46e226216292a9b5d.tar.bz2 packages_apps_Contacts-52851972282d45af9514a8c46e226216292a9b5d.zip | |
Patch URI vulnerability in contact photo editing
Don't allow reading of "file://" URIs that don't point to "/storage" during the
photo saving flow.
This is to prevent malicious apps from asking us to read our own private
files which we copy into a temporary "content://" URI that we give to a
cropping app (with permission to read).
Fixing here patches both PhotoSelectionHandler.java and
AttachPhotoActivity.java.
Tested:
Manual with the fake gallery app. Confirmed that selecting an "image"
with a URI of our own shared_pref file fails without reading it.
ContactPhotoUtilsTest
Bug: 113597344
Change-Id: Iabb4f8139cedb7d7b865d69a4b95a4997f64c71d
(cherry picked from commit ccfd94b965c1e9c2e0b239c12137c239c602070d)
CVE-2018-9587
Diffstat (limited to 'MODULE_LICENSE_APACHE2')
0 files changed, 0 insertions, 0 deletions