From 97d6f2954c879f3bfebcd241993147bced5fd50b Mon Sep 17 00:00:00 2001 From: tobiasKaminsky Date: Tue, 18 May 2021 07:55:51 +0200 Subject: [PATCH] prevent upload from sensitive path Signed-off-by: tobiasKaminsky --- .../com/owncloud/android/files/services/FileUploader.java | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/main/java/com/owncloud/android/files/services/FileUploader.java b/src/main/java/com/owncloud/android/files/services/FileUploader.java index e63520b63a22..385c3ccdaccb 100644 --- a/src/main/java/com/owncloud/android/files/services/FileUploader.java +++ b/src/main/java/com/owncloud/android/files/services/FileUploader.java @@ -29,6 +29,7 @@ import android.accounts.Account; import android.accounts.AccountManager; import android.accounts.OnAccountsUpdateListener; +import android.annotation.SuppressLint; import android.app.Notification; import android.app.NotificationManager; import android.app.PendingIntent; @@ -449,6 +450,7 @@ private Integer gatherAndStartNewUploads( /** * Start a new {@link UploadFileOperation}. */ + @SuppressLint("SdCardPath") private void startNewUpload( User user, List requestedUploads, @@ -461,6 +463,11 @@ private void startNewUpload( OCFile file, boolean disableRetries ) { + if (file.getStoragePath().startsWith("/data/data/")) { + Log_OC.d(TAG, "Upload from sensitive path is not allowed"); + return; + } + OCUpload ocUpload = new OCUpload(file, user.toPlatformAccount()); ocUpload.setFileSize(file.getFileLength()); ocUpload.setNameCollisionPolicy(nameCollisionPolicy);