Karl/BobStore
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Only accept valid package names as parameter for 'pm uninstall'

Browse Source
This commit is contained in:
Dominik Schürmann 2015-01-19 16:11:46 +01:00 committed by Hans-Christoph Steiner
parent 1f2fe25cd4
commit d941ac5eb0
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
F-Droid/src/org/fdroid/fdroid/installer/RootInstaller.java
View File

@ -28,6 +28,8 @@ import eu.chainfire.libsuperuser.Shell;
import java.io.File; import java.io.File;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.List; import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
/** /**
* Installer using a root shell and "pm install", "pm uninstall" commands * Installer using a root shell and "pm install", "pm uninstall" commands
@ -174,6 +176,13 @@ public class RootInstaller extends Installer {
} }
private void addDeleteCommand(String packageName) { private void addDeleteCommand(String packageName) {
if (!isValidPackageName(packageName)) {
Log.e(TAG, "Package name is not valid (contains characters other than letters, numbers, dots, or underscore): " + packageName);
mCallback.onError(InstallerCallback.OPERATION_DELETE,
InstallerCallback.ERROR_CODE_OTHER);
return;
}
rootSession.addCommand("pm uninstall \"" + packageName + "\"", 0, rootSession.addCommand("pm uninstall \"" + packageName + "\"", 0,
new Shell.OnCommandResultListener() { new Shell.OnCommandResultListener() {
public void onCommandResult(int commandCode, int exitCode, List<String> output) { public void onCommandResult(int commandCode, int exitCode, List<String> output) {
@ -196,6 +205,20 @@ public class RootInstaller extends Installer {
return true; return true;
} }
private static final Pattern PACKAGE_NAME_BLACKLIST = Pattern.compile("[^a-zA-Z0-9\\.\\_]");
/**
* Package names should only contain letters, numbers, dots, and underscores!
* Prevent injection attacks with app names like ";touch $'\057data\057injected'"
*
* @param packageName
* @return
*/
private boolean isValidPackageName(String packageName) {
Matcher matcher = PACKAGE_NAME_BLACKLIST.matcher(packageName);
return !matcher.find();
}
/** /**
* pm install [-l] [-r] [-t] [-i INSTALLER_PACKAGE_NAME] [-s] [-f] [--algo * pm install [-l] [-r] [-t] [-i INSTALLER_PACKAGE_NAME] [-s] [-f] [--algo
* <algorithm name> --key <key-in-hex> --iv <IV-in-hex>] [--originating-uri * <algorithm name> --key <key-in-hex> --iv <IV-in-hex>] [--originating-uri