From 2791f0b33b610247ef87278862e66c6045f89693 Mon Sep 17 00:00:00 2001 From: Sam Lee Date: Wed, 23 Mar 2016 16:42:43 -0700 Subject: [PATCH] Don't allow cachedFile Attachments if the content Uri is pointing to EmailProvider. This is to backport a security fix reported by b/27308057 and b/27335139. Also, add Analytics for these errors. Bug: b/27335139 Change-Id: Iaacb34e4983cdf9a85487222ae930cb64d80a193 --- src/com/android/email/activity/ComposeActivityEmail.java | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/com/android/email/activity/ComposeActivityEmail.java b/src/com/android/email/activity/ComposeActivityEmail.java index 4f59e2c65..cdfea0b4c 100644 --- a/src/com/android/email/activity/ComposeActivityEmail.java +++ b/src/com/android/email/activity/ComposeActivityEmail.java @@ -23,6 +23,7 @@ import android.view.MenuItem; import android.widget.EditText; import com.android.email.R; +import com.android.emailcommon.provider.EmailContent; import com.android.mail.compose.ComposeActivity; import com.android.mail.utils.LogUtils; @@ -68,4 +69,9 @@ public class ComposeActivityEmail extends ComposeActivity mBodyView.setSelection(mBodyView.getText().length()); } } + + @Override + protected String getEmailProviderAuthority() { + return EmailContent.AUTHORITY; + } }