From 3d00192dba2b153068538583ab569b56ffbc0eaa Mon Sep 17 00:00:00 2001
From: Mark Renouf <mrenouf@google.com>
Date: Wed, 15 Feb 2023 14:59:28 -0500
Subject: Prevent sharesheet from previewing unowned URIs

This is a high priority security fix.

Bug: 261036568
Test: manually via supplied tool (see bug)
Change-Id: I7e05506dc260d10984b8e56a8e657b50177ff04d
Merged-In: I7e05506dc260d10984b8e56a8e657b50177ff04d
---
 .../intentresolver/ChooserContentPreviewUi.java    | 27 +++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

(limited to 'java/src')

diff --git a/java/src/com/android/intentresolver/ChooserContentPreviewUi.java b/java/src/com/android/intentresolver/ChooserContentPreviewUi.java
index 7d627e07..aa147853 100644
--- a/java/src/com/android/intentresolver/ChooserContentPreviewUi.java
+++ b/java/src/com/android/intentresolver/ChooserContentPreviewUi.java
@@ -16,6 +16,7 @@
 
 package com.android.intentresolver;
 
+import static android.content.ContentProvider.getUserIdFromUri;
 import static java.lang.annotation.RetentionPolicy.SOURCE;
 
 import android.animation.ObjectAnimator;
@@ -28,6 +29,7 @@ import android.content.res.Resources;
 import android.database.Cursor;
 import android.graphics.Bitmap;
 import android.net.Uri;
+import android.os.UserHandle;
 import android.provider.DocumentsContract;
 import android.provider.Downloads;
 import android.provider.OpenableColumns;
@@ -341,7 +343,7 @@ public final class ChooserContentPreviewUi {
 
             ImageView previewThumbnailView = contentPreviewLayout.findViewById(
                     com.android.internal.R.id.content_preview_thumbnail);
-            if (previewThumbnail == null) {
+            if (!validForContentPreview(previewThumbnail)) {
                 previewThumbnailView.setVisibility(View.GONE);
             } else {
                 previewImageLoader.loadImage(
@@ -538,14 +540,14 @@ public final class ChooserContentPreviewUi {
         List<Uri> uris = new ArrayList<>();
         if (Intent.ACTION_SEND.equals(targetIntent.getAction())) {
             Uri uri = targetIntent.getParcelableExtra(Intent.EXTRA_STREAM);
-            if (uri != null) {
+            if (validForContentPreview(uri)) {
                 uris.add(uri);
             }
         } else {
             List<Uri> receivedUris = targetIntent.getParcelableArrayListExtra(Intent.EXTRA_STREAM);
             if (receivedUris != null) {
                 for (Uri uri : receivedUris) {
-                    if (uri != null) {
+                    if (validForContentPreview(uri)) {
                         uris.add(uri);
                     }
                 }
@@ -554,6 +556,25 @@ public final class ChooserContentPreviewUi {
         return uris;
     }
 
+    /**
+     * Indicate if the incoming content URI should be allowed.
+     *
+     * @param uri the uri to test
+     * @return true if the URI is allowed for content preview
+     */
+    private static boolean validForContentPreview(Uri uri) throws SecurityException {
+        if (uri == null) {
+            return false;
+        }
+        int userId = getUserIdFromUri(uri, UserHandle.USER_CURRENT);
+        if (userId != UserHandle.USER_CURRENT && userId != UserHandle.myUserId()) {
+            Log.e(TAG, "dropped invalid content URI belonging to user " + userId);
+            return false;
+        }
+        return true;
+    }
+
+
     private static List<ActionRow.Action> createFilePreviewActions(ActionFactory actionFactory) {
         List<ActionRow.Action> actions = new ArrayList<>(1);
         //TODO(b/120417119):
-- 
cgit v1.2.3-59-g8ed1b