Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix issue #17614141: Add protection for accessing images

Browse Source 
Add basic filename protection, also only file names that are for
app icons so this can't be abused to access thumbnails.

Change-Id: I2831c0f3f08a39aa734f93f76b6fd4aaf97e87c6
This commit is contained in:
Dianne Hackborn
2014-09-24 12:44:29 -07:00
parent 58817f502c
commit 337abb3b4e
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
services/core/java/com/android/server/am/ActivityManagerService.java
View File

@@ -8386,6 +8386,10 @@ public final class ActivityManagerService extends ActivityManagerNative
@Override
public Bitmap getTaskDescriptionIcon(String filename) {
if (!FileUtils.isValidExtFilename(filename)
|| !filename.contains(ActivityRecord.ACTIVITY_ICON_SUFFIX)) {
throw new IllegalArgumentException("Bad filename: " + filename);
}
return mTaskPersister.getTaskDescriptionIcon(filename);
}

2
services/core/java/com/android/server/am/ActivityRecord.java
View File

@@ -79,7 +79,7 @@ final class ActivityRecord {
private static final String ATTR_LAUNCHEDFROMPACKAGE = "launched_from_package";
private static final String ATTR_RESOLVEDTYPE = "resolved_type";
private static final String ATTR_COMPONENTSPECIFIED = "component_specified";
private static final String ACTIVITY_ICON_SUFFIX = "_activity_icon_";
static final String ACTIVITY_ICON_SUFFIX = "_activity_icon_";
final ActivityManagerService service; // owner
final IApplicationToken.Stub appToken; // window manager token