Signal/Android
1
0
Fork 0
mirror of https://github.com/signalapp/Signal-Android.git synced 2026-02-22 10:46:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Perform additional URI validation in ShareRepository.

Browse Source
This commit is contained in:
Greyson Parrelli
2021-02-16 12:31:18 -05:00
parent eba04eb75b
commit 04b7cb15cc
3 changed files with 93 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app/src/main/java/org/thoughtcrime/securesms/sharing/ShareRepository.java
View File

@@ -28,6 +28,7 @@ import org.thoughtcrime.securesms.mms.PartAuthority;
import org.thoughtcrime.securesms.providers.BlobProvider;
import org.thoughtcrime.securesms.util.MediaUtil;
import org.thoughtcrime.securesms.util.TextSecurePreferences;
import org.thoughtcrime.securesms.util.UriUtil;
import org.thoughtcrime.securesms.util.Util;
import org.whispersystems.libsignal.util.guava.Optional;
@@ -77,6 +78,10 @@ class ShareRepository {
return ShareData.forPrimitiveTypes();
}
if (!UriUtil.isValidExternalUri(context, uri)) {
throw new IOException("Invalid external URI!");
}
mimeType = getMimeType(context, uri, mimeType);
if (PartAuthority.isLocalUri(uri)) {

33
app/src/main/java/org/thoughtcrime/securesms/util/UriUtil.java Normal file
View File

@@ -0,0 +1,33 @@
package org.thoughtcrime.securesms.util;
import android.content.ContentResolver;
import android.content.Context;
import android.net.Uri;
import androidx.annotation.NonNull;
import java.io.File;
import java.io.IOException;
public final class UriUtil {
/**
* Ensures that an external URI is valid and doesn't contain any references to internal files or
* any other trickiness.
*/
public static boolean isValidExternalUri(@NonNull Context context, @NonNull Uri uri) {
if (ContentResolver.SCHEME_FILE.equals(uri.getScheme())) {
try {
File file = new File(uri.getPath());
return file.getCanonicalPath().equals(file.getPath()) &&
!file.getCanonicalPath().startsWith("/data") &&
!file.getCanonicalPath().contains(context.getPackageName());
} catch (IOException e) {
return false;
}
} else {
return true;
}
}
}