commit dc9ecad5c2d97213789b3fb25f5e8606d8319c98
author Abhijeet Kaur <abkaur@google.com> Wed Nov 23 08:47:27 2022 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Feb 09 00:25:14 2023 +0000
tree 93be0e747099695aed40178908e29d7e64f9f2f1
parent 269bb90f693ac51ec91f620bacdb81ccd177aefd

Canonicalise path before extracting relative path

This helps us make accurate access checks on the given path.

Bug: 228833816
Bug: 228450832
Test: atest FileUtilsTest
Test: atest LegacyStorageHostTest
Change-Id: Id620644ffdfe20e9281773e2e23851c56732dd11
Merged-In: Id620644ffdfe20e9281773e2e23851c56732dd11
(cherry picked from commit 93f5186e4b4a044e00a168c55e05fd3835033221)
(cherry picked from commit 1426f04cd2b4940f9308432d37cc4ef79a7d8340)
Merged-In: Id620644ffdfe20e9281773e2e23851c56732dd11

src/com/android/providers/media/util/FileUtils.java

diff --git a/src/com/android/providers/media/util/FileUtils.java b/src/com/android/providers/media/util/FileUtils.java
index bbf04de..2e2a3e7 100644
--- a/src/com/android/providers/media/util/FileUtils.java
+++ b/src/com/android/providers/media/util/FileUtils.java
@@ -1110,7 +1110,9 @@
     }
 
     public static @Nullable String extractRelativePath(@Nullable String data) {
+        data = getCanonicalPath(data);
         if (data == null) return null;
+
         final Matcher matcher = PATTERN_RELATIVE_PATH.matcher(data);
         if (matcher.find()) {
             final int lastSlash = data.lastIndexOf('/');
@@ -1758,4 +1760,16 @@
     public static File fromFuseFile(File file) {
         return new File(file.getPath().replaceFirst(FUSE_FS_PREFIX, LOWER_FS_PREFIX));
     }
+
+    @Nullable
+    private static String getCanonicalPath(@Nullable String path) {
+        if (path == null) return null;
+
+        try {
+            return new File(path).getCanonicalPath();
+        } catch (IOException e) {
+            Log.d(TAG, "Unable to get canonical path from invalid data path: " + path, e);
+            return null;
+        }
+    }
 }

tests/src/com/android/providers/media/util/FileUtilsTest.java

diff --git a/tests/src/com/android/providers/media/util/FileUtilsTest.java b/tests/src/com/android/providers/media/util/FileUtilsTest.java
index a1f2b82..5a4b47d 100644
--- a/tests/src/com/android/providers/media/util/FileUtilsTest.java
+++ b/tests/src/com/android/providers/media/util/FileUtilsTest.java
@@ -543,7 +543,15 @@
                     extractRelativePath(prefix + "DCIM/foo.jpg"));
             assertEquals("DCIM/My Vacation/",
                     extractRelativePath(prefix + "DCIM/My Vacation/foo.jpg"));
+            assertEquals("Pictures/",
+                    extractRelativePath(prefix + "DCIM/../Pictures/.//foo.jpg"));
+            assertEquals("/",
+                    extractRelativePath(prefix + "DCIM/Pictures/./..//..////foo.jpg"));
+            assertEquals("Android/data/",
+                    extractRelativePath(prefix + "DCIM/foo.jpg/.//../../Android/data/poc"));
         }
+
+        assertEquals(null, extractRelativePath("/sdcard/\\\u0000"));
     }
 
     @Test