Merge "Sanity-check paths of files to be restored" into jb-mr2-dev

2014-09-23 16:13:41 +00:00
parent 59c1202e10 7bc601d5d7
commit e2adb1ff4a
1 changed files with 8 additions and 0 deletions
--- a/services/java/com/android/server/BackupManagerService.java
+++ b/services/java/com/android/server/BackupManagerService.java
@@ -3390,6 +3390,14 @@ class BackupManagerService extends IBackupManager.Stub {
                                break;
                        }

+                        // The path needs to be canonical
+                        if (info.path.contains("..") || info.path.contains("//")) {
+                            if (MORE_DEBUG) {
+                                Slog.w(TAG, "Dropping invalid path " + info.path);
+                            }
+                            okay = false;
+                        }
+
                        // If the policy is satisfied, go ahead and set up to pipe the
                        // data to the agent.
                        if (DEBUG && okay && mAgent != null) {