Mirrors/DroidDeck
1
0 Fork 0
mirror of https://github.com/Droid-Deck/DroidDeck.git synced 2026-11-11 11:01:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: file provider rejects document ids with . or .. segments (#1016)

Browse Source
This commit is contained in:
Resul Övür authored and GitHub committed 2026-10-20 17:58:36 -04:00
1 parent 5f9acf51d4
commit 276bfd7fa2
1 file changed
+2 -2
Download Patch File Download Diff File Expand all files Collapse all files
app/src/main/java/com/droiddeck/launcher/files/AppFilesProvider.kt
+2 -2
View File
@@ -85,7 +85,7 @@ class AppFilesProvider : DocumentsProvider() {
override fun deleteDocument(documentId: String) {
val file = fileFor(documentId)
if (file.absolutePath == base.absolutePath) throw FileNotFoundException("the app folder itself is not deleted")
if (file.canonicalPath == baseCanonical) throw FileNotFoundException("the app folder itself is not deleted")
try {
deleteTree(file.toPath())
} catch (e: IOException) {
@@ -154,7 +154,7 @@ class AppFilesProvider : DocumentsProvider() {
private fun fileFor(documentId: String): File {
val f = File(documentId)
if (!f.isAbsolute || !inside(f)) throw FileNotFoundException("$documentId is outside the app's files")
if (!f.isAbsolute || f.normalize().path != documentId || !inside(f)) throw FileNotFoundException("$documentId is outside the app's files")
if (!f.exists()) throw FileNotFoundException("$documentId not found")
return f
}