PawletOS/app_Settings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HTML injection fix for bluetooth pairing, issue 65946

Browse Source 
During bluetooth pairing, HTML injection is possible via the device name displayed to the user. This escapes the device name, before creating HTML from it, so it will preserve things like < and > but will not affect rendering of HTML

Bug: 12976386
Change-Id: I8a02d3be8c1a779dc9ed1c9ef8083a1159ab3f2b
This commit is contained in:
Rob Fletcher
2014-02-25 18:16:12 +00:00
parent 0223f9c5dd
commit 7b0686af2f
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/com/android/settings/bluetooth/BluetoothPairingDialog.java
View File

@@ -207,8 +207,8 @@ public final class BluetoothPairingDialog extends AlertActivity implements
return null; return null;
} }
// Format the message string, then parse HTML style tags // HTML escape deviceName, Format the message string, then parse HTML style tags
String messageText = getString(messageId1, deviceName); String messageText = getString(messageId1, Html.escapeHtml(deviceName));
messageView.setText(Html.fromHtml(messageText)); messageView.setText(Html.fromHtml(messageText));
messageView2.setText(messageId2); messageView2.setText(messageId2);
mPairingView.setInputType(InputType.TYPE_CLASS_NUMBER); mPairingView.setInputType(InputType.TYPE_CLASS_NUMBER);
@@ -220,7 +220,8 @@ public final class BluetoothPairingDialog extends AlertActivity implements
private View createView(CachedBluetoothDeviceManager deviceManager) { private View createView(CachedBluetoothDeviceManager deviceManager) {
View view = getLayoutInflater().inflate(R.layout.bluetooth_pin_confirm, null); View view = getLayoutInflater().inflate(R.layout.bluetooth_pin_confirm, null);
String name = deviceManager.getName(mDevice); // Escape device name to avoid HTML injection.
String name = Html.escapeHtml(deviceManager.getName(mDevice));
TextView messageView = (TextView) view.findViewById(R.id.message); TextView messageView = (TextView) view.findViewById(R.id.message);
String messageText; // formatted string containing HTML style tags String messageText; // formatted string containing HTML style tags