Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 337abb3b authored by Dianne Hackborn's avatar Dianne Hackborn
Browse files

Fix issue #17614141: Add protection for accessing images 

Add basic filename protection, also only file names that are for
app icons so this can't be abused to access thumbnails.

Change-Id: I2831c0f3f08a39aa734f93f76b6fd4aaf97e87c6
parent 58817f50

services/core/java/com/android/server/am/ActivityManagerService.java

+4 −0
Original line number Diff line number Diff line
@@ -8386,6 +8386,10 @@ public final class ActivityManagerService extends ActivityManagerNative 














    @Override















    public Bitmap getTaskDescriptionIcon(String filename) {













        if (!FileUtils.isValidExtFilename(filename)













                || !filename.contains(ActivityRecord.ACTIVITY_ICON_SUFFIX)) {













            throw new IllegalArgumentException("Bad filename: " + filename);













        }















        return mTaskPersister.getTaskDescriptionIcon(filename);















    }















































services/core/java/com/android/server/am/ActivityRecord.java



+1
−1




























Original line number
Diff line number
Diff line








@@ -79,7 +79,7 @@ final class ActivityRecord {













    private static final String ATTR_LAUNCHEDFROMPACKAGE = "launched_from_package";















    private static final String ATTR_RESOLVEDTYPE = "resolved_type";















    private static final String ATTR_COMPONENTSPECIFIED = "component_specified";













    private static final String ACTIVITY_ICON_SUFFIX = "_activity_icon_";













    static final String ACTIVITY_ICON_SUFFIX = "_activity_icon_";































    final ActivityManagerService service; // owner















    final IApplicationToken.Stub appToken; // window manager token