Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e7a6b10 authored by Christopher Tate's avatar Christopher Tate Committed by Android Git Automerger
Browse files

am 0e3411b2: am d738f49a: am b559b58e: am 5769c0b8: am 9432f83c: am 7b3ac9ad:...

am 0e3411b2: am d738f49a: am b559b58e: am 5769c0b8: am 9432f83c: am 7b3ac9ad: am 0cb27e28: Validate restored file paths against their nominal domain

* commit '0e3411b2':
  Validate restored file paths against their nominal domain
parents 9d262c49 0e3411b2
Loading
Loading
Loading
Loading
+19 −9
Original line number Diff line number Diff line
@@ -440,22 +440,32 @@ public abstract class BackupAgent extends ContextWrapper {
            basePath = getCacheDir().getCanonicalPath();
        } else {
            // Not a supported location
            Log.i(TAG, "Data restored from non-app domain " + domain + ", ignoring");
            Log.i(TAG, "Unrecognized domain " + domain);
        }

        // Now that we've figured out where the data goes, send it on its way
        if (basePath != null) {
            // Canonicalize the nominal path and verify that it lies within the stated domain
            File outFile = new File(basePath, path);
            if (DEBUG) Log.i(TAG, "[" + domain + " : " + path + "] mapped to " + outFile.getPath());
            String outPath = outFile.getCanonicalPath();
            if (outPath.startsWith(basePath + File.separatorChar)) {
                if (DEBUG) Log.i(TAG, "[" + domain + " : " + path + "] mapped to " + outPath);
                onRestoreFile(data, size, outFile, type, mode, mtime);
                return;
            } else {
            // Not a supported output location?  We need to consume the data
                // Attempt to restore to a path outside the file's nominal domain.
                if (DEBUG) {
                    Log.e(TAG, "Cross-domain restore attempt: " + outPath);
                }
            }
        }

        // Not a supported output location, or bad path:  we need to consume the data
        // anyway, so just use the default "copy the data out" implementation
        // with a null destination.
            if (DEBUG) Log.i(TAG, "[ skipping data from unsupported domain " + domain + "]");
        if (DEBUG) Log.i(TAG, "[ skipping file " + path + "]");
        FullBackup.restoreFile(data, size, type, mode, mtime, null);
    }
    }

    // ----- Core implementation -----