Validate ringtone URIs before setting

Add checks URIs for content from other users.
 Fail for users that are not profiles of the current user.

Test: atest DefaultRingtonePreferenceTest
Bug: 299614635
Change-Id: Ib266b285a3a1c6c5265ae2321159e61e08e349f6
This commit is contained in:
Valentin Iftime
2023-10-03 17:28:34 +02:00
parent a223c7644e
commit 323fbda20e
4 changed files with 172 additions and 15 deletions

View File

@@ -51,16 +51,9 @@ public class DefaultRingtonePreference extends RingtonePreference {
return;
}
String mimeType = mUserContext.getContentResolver().getType(ringtoneUri);
if (mimeType == null) {
if (!isValidRingtoneUri(ringtoneUri)) {
Log.e(TAG, "onSaveRingtone for URI:" + ringtoneUri
+ " ignored: failure to find mimeType (no access from this context?)");
return;
}
if (!(mimeType.startsWith("audio/") || mimeType.equals("application/ogg"))) {
Log.e(TAG, "onSaveRingtone for URI:" + ringtoneUri
+ " ignored: associated mimeType:" + mimeType + " is not an audio type");
+ " ignored: invalid ringtone Uri");
return;
}