From dd38f72f6013f896863ce0a43f0ddfdfcdff16a9 Mon Sep 17 00:00:00 2001 From: Greyson Parrelli Date: Fri, 10 Jul 2026 05:59:59 +0000 Subject: [PATCH] Validate content URI authority in system contacts entrypoint. --- .../securesms/SystemContactsEntrypointViewModel.kt | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/app/src/main/java/org/thoughtcrime/securesms/SystemContactsEntrypointViewModel.kt b/app/src/main/java/org/thoughtcrime/securesms/SystemContactsEntrypointViewModel.kt index 0edcf0b2ea..5d72da6e12 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/SystemContactsEntrypointViewModel.kt +++ b/app/src/main/java/org/thoughtcrime/securesms/SystemContactsEntrypointViewModel.kt @@ -79,7 +79,13 @@ class SystemContactsEntrypointViewModel : ViewModel() { } private fun getDestinationForSyncAdapter(context: Context, intent: Intent): DestinationAndBody { - context.contentResolver.query(intent.data!!, null, null, null, null).use { cursor -> + val uri = intent.data + if (uri == null || uri.authority != ContactsContract.AUTHORITY) { + Log.w(TAG, "Ignoring content URI with an unexpected authority.") + return DestinationAndBody("", "") + } + + context.contentResolver.query(uri, null, null, null, null).use { cursor -> if (cursor != null && cursor.moveToNext()) { return DestinationAndBody(cursor.getString(cursor.getColumnIndexOrThrow(ContactsContract.RawContacts.Data.DATA1)), "") }