Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0b4cd450 authored by Abhijeet Kaur's avatar Abhijeet Kaur Committed by android-build-team Robot
Browse files

Validate user-supplied tree URIs in DocumentsProvider calls 

Currently we only validate DocumentsContract.EXTRA_URI, this change
validates other URIs suchs as DocumentsContract.EXTRA_TARGET_URI and
DocumentsContract.EXTRA_PARENT_URI as well

Bug: 157320716
Test: Manually using the test app in b/157320716#comment1
Change-Id: I90fd1e62aa7dc333bf32eb80ccc5b181a1d54e41
Merged-In: I90fd1e62aa7dc333bf32eb80ccc5b181a1d54e41
(cherry picked from commit b9f4fb79)
(cherry picked from commit eca247f2)
parent cdb91341

core/java/android/provider/DocumentsProvider.java

+12 −5
Original line number Diff line number Diff line
@@ -218,8 +218,15 @@ public abstract class DocumentsProvider extends ContentProvider { 
    }



    /** {@hide} */

    private void enforceTree(Uri documentUri) {

        if (isTreeUri(documentUri)) {

    private void enforceTreeForExtraUris(Bundle extras) {

        enforceTree(extras.getParcelable(DocumentsContract.EXTRA_URI));

        enforceTree(extras.getParcelable(DocumentsContract.EXTRA_PARENT_URI));

        enforceTree(extras.getParcelable(DocumentsContract.EXTRA_TARGET_URI));

    }



    /** {@hide} */

    private void enforceTree(@Nullable Uri documentUri) {

        if (documentUri != null && isTreeUri(documentUri)) {

            final String parent = getTreeDocumentId(documentUri);

            final String child = getDocumentId(documentUri);

            if (Objects.equals(parent, child)) {
@@ -1080,6 +1087,9 @@ public abstract class DocumentsProvider extends ContentProvider { 
        final Context context = getContext();

        final Bundle out = new Bundle();



        // If the URI is a tree URI performs some validation.

        enforceTreeForExtraUris(extras);



        final Uri extraUri = validateIncomingNullableUri(

                extras.getParcelable(DocumentsContract.EXTRA_URI));

        final Uri extraTargetUri = validateIncomingNullableUri(
@@ -1110,9 +1120,6 @@ public abstract class DocumentsProvider extends ContentProvider { 
                    "Requested authority " + authority + " doesn't match provider " + mAuthority);

        }



        // If the URI is a tree URI performs some validation.

        enforceTree(documentUri);



        if (METHOD_IS_CHILD_DOCUMENT.equals(method)) {

            enforceReadPermissionInner(documentUri, getCallingPackage(),

                    getCallingAttributionTag(), null);