commit ff562d068d5a3a41999aada06ed46994d8f6efb4
author Jeff Sharkey <jsharkey@android.com> Tue Feb 16 16:08:21 2016 -0700
committer The Android Automerger <android-build@google.com> Fri Feb 26 16:56:20 2016 -0800
tree 1271d0a2d3c5754202130cf4880098dbcb3a2414
parent a9216759e8a88e249183d17e311d2a652e5b35ce

DO NOT MERGE. Use resolved path when inserting and deleting.

This avoids a race condition where someone can change a symlink
target after the security checks have passed.

Bug: 26211054
Change-Id: Ia58425ab71c1472dd2f2dd31dae000ca29d0bcb2

src/com/android/providers/downloads/DownloadProvider.java

diff --git a/src/com/android/providers/downloads/DownloadProvider.java b/src/com/android/providers/downloads/DownloadProvider.java
index 620085f..d9acc78 100644
--- a/src/com/android/providers/downloads/DownloadProvider.java
+++ b/src/com/android/providers/downloads/DownloadProvider.java
@@ -715,7 +715,13 @@
             throw new IllegalArgumentException("Invalid file URI: " + uri);
         }
 
-        final File file = new File(path);
+        final File file;
+        try {
+            file = new File(path).getCanonicalFile();
+        } catch (IOException e) {
+            throw new SecurityException(e);
+        }
+
         if (Helpers.isFilenameValidInExternalPackage(getContext(), file, getCallingPackage())) {
             // No permissions required for paths belonging to calling package
             return;
@@ -1191,10 +1197,14 @@
 
                         final String path = cursor.getString(1);
                         if (!TextUtils.isEmpty(path)) {
-                            final File file = new File(path);
-                            if (Helpers.isFilenameValid(getContext(), file)) {
-                                Log.v(Constants.TAG, "Deleting " + file + " via provider delete");
-                                file.delete();
+                            try {
+                                final File file = new File(path).getCanonicalFile();
+                                if (Helpers.isFilenameValid(getContext(), file)) {
+                                    Log.v(Constants.TAG,
+                                            "Deleting " + file + " via provider delete");
+                                    file.delete();
+                                }
+                            } catch (IOException ignored) {
                             }
                         }
                     }