From 0d0b9d345c200adb4118b3898eba5b7ad5003c27 Mon Sep 17 00:00:00 2001 From: Greyson Parrelli Date: Fri, 10 Jul 2026 05:23:28 +0000 Subject: [PATCH] Strip user-ID prefix from content authority in isValidExternalUri. --- app/src/main/java/org/thoughtcrime/securesms/util/UriUtil.kt | 5 ++++- .../securesms/util/UriUtilTest_isValidExternalUri.java | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/app/src/main/java/org/thoughtcrime/securesms/util/UriUtil.kt b/app/src/main/java/org/thoughtcrime/securesms/util/UriUtil.kt index 02b74e8d56..cbe28d42ed 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/util/UriUtil.kt +++ b/app/src/main/java/org/thoughtcrime/securesms/util/UriUtil.kt @@ -32,7 +32,10 @@ object UriUtil { } } else if (ContentResolver.SCHEME_CONTENT == uri.scheme) { val authority = uri.authority ?: return false - return !authority.startsWith(context.packageName) + + // Protect against URI's like "content://0@org.thoughtcrime.securesms.part/..." + val normalizedAuthority = authority.substringAfterLast('@') + return !normalizedAuthority.startsWith(context.packageName) } else { return true } diff --git a/app/src/test/java/org/thoughtcrime/securesms/util/UriUtilTest_isValidExternalUri.java b/app/src/test/java/org/thoughtcrime/securesms/util/UriUtilTest_isValidExternalUri.java index b437145304..699060223d 100644 --- a/app/src/test/java/org/thoughtcrime/securesms/util/UriUtilTest_isValidExternalUri.java +++ b/app/src/test/java/org/thoughtcrime/securesms/util/UriUtilTest_isValidExternalUri.java @@ -38,6 +38,10 @@ public class UriUtilTest_isValidExternalUri { { "content://" + APPLICATION_ID + ".blob/blob/42", false }, { "content://" + APPLICATION_ID + ".avatar/avatar/42", false }, { "content://" + APPLICATION_ID + ".fileprovider/external_files/f", false }, + { "content://0@" + APPLICATION_ID + ".part/part/42", false }, + { "content://10@" + APPLICATION_ID + ".blob/blob/42", false }, + { "content://0@0@" + APPLICATION_ID + ".part/part/42", false }, + { "content://0@other.app.package.name.org/path/public.txt", true }, { "file:///sdcard/public.txt", true }, {"file:///data/data/" + APPLICATION_ID + "/private.txt", false }, {"file:///any/path/with/package/name/" + APPLICATION_ID, false },