Get the latest tech news

Improperly trusting ContentProvider-provided filename


OWASP category: MASVS-CODE: Code Quality Overview FileProvider, a subclass of ContentProvider, is intended to provide a secure method for an application ("server application") to share files with another application ("client application"). However, if the client application does not properly handle the filename provided by the server application, an attacker-controlled server application may be able to implement its own malicious FileProvider to overwrite files in the client application's app-specific storage.

In other words: When the client application writes the received file to storage, it should ignore the filename provided by the server application and instead use its own internally generated unique identifier as the filename. Sanitize the provided filename when writing the received file to storage. Contributors: Dimitrios Valsamaras and Michael Peck of Microsoft Threat Intelligence

Get the Android app

Or read this on Hacker News

Read more on:

Photo of provided filename

provided filename

Photo of ContentProvider

ContentProvider