Merge "Messenger refuses all file:///data/ uris" into nyc-dev
diff --git a/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java b/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java
index 396f1da..83b7be9 100644
--- a/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java
+++ b/src/com/android/messaging/ui/conversationlist/ShareIntentActivity.java
@@ -159,7 +159,7 @@
}
private void addSharedImagePartToDraft(final String contentType, final Uri imageUri) {
- if (FileUtil.isInPrivateDir(getBaseContext(), imageUri)) {
+ if (FileUtil.isInPrivateDir(imageUri)) {
Assert.fail("Cannot send private file " + imageUri.toString());
} else {
mDraftMessage.addPart(PendingAttachmentData.createPendingAttachmentData(contentType,
diff --git a/src/com/android/messaging/util/FileUtil.java b/src/com/android/messaging/util/FileUtil.java
index f8051ed..e35e79b 100644
--- a/src/com/android/messaging/util/FileUtil.java
+++ b/src/com/android/messaging/util/FileUtil.java
@@ -19,6 +19,7 @@
import android.content.ContentResolver;
import android.content.Context;
import android.net.Uri;
+import android.os.Environment;
import android.text.TextUtils;
import android.webkit.MimeTypeMap;
@@ -123,14 +124,15 @@
return TextUtils.equals(uri.getScheme(), ContentResolver.SCHEME_FILE);
}
- // Checks if the file is in /data/data/com.android.messaging
- // The other app folders are either symlinks to this, or hold non-private data like binaries.
- public static boolean isInPrivateDir(Context context, Uri uri) {
+ // Checks if the file is in /data, and don't allow any app to send personal information.
+ // We're told it's possible to create world readable hardlinks to other apps private data
+ // so we ban all /data file uris.
+ public static boolean isInPrivateDir(Uri uri) {
if (!isFileUri(uri)) {
return false;
}
final File file = new File(uri.getPath());
- return FileUtil.isSameOrSubDirectory(new File(context.getApplicationInfo().dataDir), file);
+ return FileUtil.isSameOrSubDirectory(Environment.getDataDirectory(), file);
}
/**
