commit e5b6a4326aa12e935996134093e19d6b956b052d
author Ekin Oguz <ekinoguz@google.com> Mon Jan 29 13:11:35 2018 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Sat Feb 03 00:11:14 2018 +0000
tree dcaeb0d9cc57f64383c5eb3a7d8e3a4707c929d9
parent 12621e8897d14f3b57eeb5ff09f6bd9cb638d202

Disallow attaching files from our own EmailAttachmentProvider.

This is to backport a security fix reported in b/71814449 and
b/72569023. Fix is using the same approach as b/27308057, which is to
prevent Compose from accepting URIs with our own email attachment
provider.

Bug: b/71814449
Change-Id: Ib9df21648d00d2ef2da9fac05cc39fee253de8e2
(cherry picked from commit 7227751994624bdb2ba958714cc861b8bab41634)

src/com/android/email/activity/ComposeActivityEmail.java

diff --git a/src/com/android/email/activity/ComposeActivityEmail.java b/src/com/android/email/activity/ComposeActivityEmail.java
index cdfea0b..5783531 100644
--- a/src/com/android/email/activity/ComposeActivityEmail.java
+++ b/src/com/android/email/activity/ComposeActivityEmail.java
@@ -74,4 +74,9 @@
     protected String getEmailProviderAuthority() {
         return EmailContent.AUTHORITY;
     }
+
+    @Override
+    protected String getEmailAttachmentProviderAuthority() {
+        return EmailContent.Attachment.ATTACHMENT_PROVIDER_AUTHORITY;
+    }
 }