Forbid content from MmsFileProvider in Bluetooth Share
Bug: 179910660
Test: verified against POC
Change-Id: I8a888e67ba70d4a8b5721e4124bd8ccb671baaf7
(cherry picked from commit 5fd89df71e29571cde91c4a899939496002b2499)
diff --git a/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java b/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java
index 6d7fe95..641fed0 100644
--- a/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java
+++ b/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java
@@ -110,6 +110,12 @@
// This will allow more 3rd party applications to share files via
// bluetooth
if ("content".equals(scheme)) {
+ if (fromExternal && BluetoothOppUtility.isForbiddenContent(uri)) {
+ EventLog.writeEvent(0x534e4554, "179910660", -1, uri.toString());
+ Log.e(TAG, "Content from forbidden URI is not allowed.");
+ return SEND_FILE_INFO_ERROR;
+ }
+
contentType = contentResolver.getType(uri);
Cursor metadataCursor;
try {
diff --git a/src/com/android/bluetooth/opp/BluetoothOppUtility.java b/src/com/android/bluetooth/opp/BluetoothOppUtility.java
index 1b5cd59..6b1dcc2 100644
--- a/src/com/android/bluetooth/opp/BluetoothOppUtility.java
+++ b/src/com/android/bluetooth/opp/BluetoothOppUtility.java
@@ -410,6 +410,13 @@
return isSameOrSubDirectory(Environment.getExternalStorageDirectory(), file);
}
+ static boolean isForbiddenContent(Uri uri) {
+ if ("com.android.bluetooth.map.MmsFileProvider".equals(uri.getHost())) {
+ return true;
+ }
+ return false;
+ }
+
/**
* Checks, whether the child directory is the same as, or a sub-directory of the base
* directory. Neither base nor child should be null.
