Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7d99b2d1 authored by Jack He's avatar Jack He Committed by MSe
Browse files

[BACKPORT] OPP: Restrict file based URI access to external storage 

* Allow only external storage paths in file based URI in
  BluetoothOppSendFileInfo when the file send request comes from an
  external source
* Fix a potential NPE when using Uri.getPath()

Bug: 35310991
Test: Make, test various cases of Bluetooth file share
AOSP-Change-Id: I8ff00d63d3c880667302f8d7ff8eaa0c0b533921
(cherry picked from commit 3edd7f0a)
(cherry picked from commit 3ce229fa)

CVE-2017-0639

Change-Id: I8e90c92ae7be6819528e35638bf033f4826af16d
parent 63909f33

src/com/android/bluetooth/opp/BluetoothOppHandoverReceiver.java

+2 −2
Original line number Diff line number Diff line
@@ -52,7 +52,7 @@ public class BluetoothOppHandoverReceiver extends BroadcastReceiver { 
                    // Save type/stream, will be used when adding transfer

                    // session to DB.

                    BluetoothOppManager.getInstance(context).saveSendingFileInfo(type,

                            stream.toString(), true);

                            stream.toString(), true /* isHandover */, true /* fromExternal */);

                } else {

                    if (D) Log.d(TAG, "No mimeType or stream attached to handover request");

                }
@@ -62,7 +62,7 @@ public class BluetoothOppHandoverReceiver extends BroadcastReceiver { 
                uris = intent.getParcelableArrayListExtra(Intent.EXTRA_STREAM);

                if (mimeType != null && uris != null) {

                    BluetoothOppManager.getInstance(context).saveSendingFileInfo(mimeType,

                            uris, true);

                            uris, true /* isHandover */, true /* fromExternal */);

                } else {

                    if (D) Log.d(TAG, "No mimeType or stream attached to handover request");

                    return;

src/com/android/bluetooth/opp/BluetoothOppLauncherActivity.java

+6 −3
Original line number Diff line number Diff line
@@ -111,7 +111,8 @@ public class BluetoothOppLauncherActivity extends Activity { 
                    Thread t = new Thread(new Runnable() {

                        public void run() {

                            BluetoothOppManager.getInstance(BluetoothOppLauncherActivity.this)

                                .saveSendingFileInfo(type,stream.toString(), false);

                                .saveSendingFileInfo(type,stream.toString(),

                                    false /* isHandover */, true /* fromExternal */);

                            //Done getting file info..Launch device picker and finish this activity

                            launchDevicePicker();

                            finish();
@@ -127,7 +128,8 @@ public class BluetoothOppLauncherActivity extends Activity { 
                        Thread t = new Thread(new Runnable() {

                            public void run() {

                                BluetoothOppManager.getInstance(BluetoothOppLauncherActivity.this)

                                    .saveSendingFileInfo(type,fileUri.toString(), false);

                                    .saveSendingFileInfo(type,fileUri.toString(),

                                        false /* isHandover */, false /* fromExternal */);

                                //Done getting file info..Launch device picker

                                //and finish this activity

                                launchDevicePicker();
@@ -155,7 +157,8 @@ public class BluetoothOppLauncherActivity extends Activity { 
                    Thread t = new Thread(new Runnable() {

                        public void run() {

                            BluetoothOppManager.getInstance(BluetoothOppLauncherActivity.this)

                                .saveSendingFileInfo(mimeType,uris, false);

                                .saveSendingFileInfo(mimeType,uris,

                                    false /* isHandover */, true /* fromExternal */);

                            //Done getting file info..Launch device picker

                            //and finish this activity

                            launchDevicePicker();

src/com/android/bluetooth/opp/BluetoothOppManager.java

+10 −6
Original line number Diff line number Diff line
@@ -248,28 +248,32 @@ public class BluetoothOppManager { 
        if (V) Log.v(TAG, "Application data stored to SharedPreference! ");

    }



    public void saveSendingFileInfo(String mimeType, String uriString, boolean isHandover) {

    public void saveSendingFileInfo(String mimeType, String uriString, boolean isHandover,

            boolean fromExternal) {

        synchronized (BluetoothOppManager.this) {

            mMultipleFlag = false;

            mMimeTypeOfSendingFile = mimeType;

            mUriOfSendingFile = uriString;

            mIsHandoverInitiated = isHandover;

            Uri uri = Uri.parse(uriString);

            BluetoothOppUtility.putSendFileInfo(uri,

                    BluetoothOppSendFileInfo.generateFileInfo(mContext, uri, mimeType));

            BluetoothOppUtility.putSendFileInfo(

                    uri, BluetoothOppSendFileInfo.generateFileInfo(

                                 mContext, uri, mimeType, fromExternal));

            storeApplicationData();

        }

    }



    public void saveSendingFileInfo(String mimeType, ArrayList<Uri> uris, boolean isHandover) {

    public void saveSendingFileInfo(String mimeType, ArrayList<Uri> uris, boolean isHandover,

            boolean fromExternal) {

        synchronized (BluetoothOppManager.this) {

            mMultipleFlag = true;

            mMimeTypeOfSendingFiles = mimeType;

            mUrisOfSendingFiles = uris;

            mIsHandoverInitiated = isHandover;

            for (Uri uri : uris) {

                BluetoothOppUtility.putSendFileInfo(uri,

                        BluetoothOppSendFileInfo.generateFileInfo(mContext, uri, mimeType));

                BluetoothOppUtility.putSendFileInfo(

                        uri, BluetoothOppSendFileInfo.generateFileInfo(

                                     mContext, uri, mimeType, fromExternal));

            }

            storeApplicationData();

        }

src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java

+13 −2
Original line number Diff line number Diff line
@@ -39,6 +39,7 @@ import android.database.Cursor; 
import android.database.sqlite.SQLiteException;

import android.net.Uri;

import android.provider.OpenableColumns;

import android.util.EventLog;

import android.util.Log;



import java.io.File;
@@ -97,8 +98,8 @@ public class BluetoothOppSendFileInfo { 
        mStatus = status;

    }



    public static BluetoothOppSendFileInfo generateFileInfo(Context context, Uri uri,

            String type) {

    public static BluetoothOppSendFileInfo generateFileInfo(

            Context context, Uri uri, String type, boolean fromExternal) {

        ContentResolver contentResolver = context.getContentResolver();

        String scheme = uri.getScheme();

        String fileName = null;
@@ -139,6 +140,16 @@ public class BluetoothOppSendFileInfo { 
                fileName = uri.getLastPathSegment();

            }

        } else if ("file".equals(scheme)) {

            if (uri.getPath() == null) {

                Log.e(TAG, "Invalid URI path: " + uri);

                return SEND_FILE_INFO_ERROR;

            }

            if (fromExternal && !BluetoothOppUtility.isInExternalStorageDir(uri)) {

                EventLog.writeEvent(0x534e4554, "35310991", -1, uri.getPath());

                Log.e(TAG,

                        "File based URI not in Environment.getExternalStorageDirectory() is not allowed.");

                return SEND_FILE_INFO_ERROR;

            }

            fileName = uri.getLastPathSegment();

            contentType = type;

            File f = new File(uri.getPath());

src/com/android/bluetooth/opp/BluetoothOppTransferActivity.java

+1 −1
Original line number Diff line number Diff line
@@ -401,7 +401,7 @@ public class BluetoothOppTransferActivity extends AlertActivity implements 
                        public void run() {

                            BluetoothOppSendFileInfo sendFileInfo =

                                BluetoothOppSendFileInfo.generateFileInfo(BluetoothOppTransferActivity.this,

                                uri, mTransInfo.mFileType);

                                uri, mTransInfo.mFileType, false);

                            uri = BluetoothOppUtility.generateUri(uri, sendFileInfo);

                            BluetoothOppUtility.putSendFileInfo(uri, sendFileInfo);

                            mTransInfo.mFileUri = uri.toString();