Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Validate restored file paths against their nominal domain

Browse Source 
Bug 8460775

(cherry picked from commit 7323765bbf)

Change-Id: I6710503799a6df2de142a827513d5b4c107b6ec9
This commit is contained in:
Christopher Tate
2013-03-25 10:06:34 -07:00
committed by Nick Kralevich
parent a2e929e1df
commit 0cb27e2807
1 changed files with 19 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
core/java/android/app/backup/BackupAgent.java
View File

@@ -440,21 +440,31 @@ public abstract class BackupAgent extends ContextWrapper {
basePath = getCacheDir().getCanonicalPath();
} else {
// Not a supported location
Log.i(TAG, "Data restored from non-app domain " + domain + ", ignoring");
Log.i(TAG, "Unrecognized domain " + domain);
}
// Now that we've figured out where the data goes, send it on its way
if (basePath != null) {
// Canonicalize the nominal path and verify that it lies within the stated domain
File outFile = new File(basePath, path);
if (DEBUG) Log.i(TAG, "[" + domain + " : " + path + "] mapped to " + outFile.getPath());
onRestoreFile(data, size, outFile, type, mode, mtime);
} else {
// Not a supported output location? We need to consume the data
// anyway, so just use the default "copy the data out" implementation
// with a null destination.
if (DEBUG) Log.i(TAG, "[ skipping data from unsupported domain " + domain + "]");
FullBackup.restoreFile(data, size, type, mode, mtime, null);
String outPath = outFile.getCanonicalPath();
if (outPath.startsWith(basePath + File.separatorChar)) {
if (DEBUG) Log.i(TAG, "[" + domain + " : " + path + "] mapped to " + outPath);
onRestoreFile(data, size, outFile, type, mode, mtime);
return;
} else {
// Attempt to restore to a path outside the file's nominal domain.
if (DEBUG) {
Log.e(TAG, "Cross-domain restore attempt: " + outPath);
}
}
}
// Not a supported output location, or bad path: we need to consume the data
// anyway, so just use the default "copy the data out" implementation
// with a null destination.
if (DEBUG) Log.i(TAG, "[ skipping file " + path + "]");
FullBackup.restoreFile(data, size, type, mode, mtime, null);
}
// ----- Core implementation -----