commit 25c866a8efa148886280b34c0413a1c2c20c247f
author Jeff Vander Stoep <jeffv@google.com> Tue Sep 23 16:24:36 2014 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Sep 23 16:24:36 2014 +0000
tree 2d928ea084620bbd8d13d7cf7c2f405f5b75e706
parent 660af7eb1a55e2df7da45aa63ca227141ef86b34
parent e2adb1ff4af09d66096df64461c80d4126ab2692

am e2adb1ff: Merge "Sanity-check paths of files to be restored" into jb-mr2-dev

* commit 'e2adb1ff4af09d66096df64461c80d4126ab2692':
  Sanity-check paths of files to be restored

services/java/com/android/server/BackupManagerService.java

diff --git a/services/java/com/android/server/BackupManagerService.java b/services/java/com/android/server/BackupManagerService.java
index a537e99..2c88c32 100644
--- a/services/java/com/android/server/BackupManagerService.java
+++ b/services/java/com/android/server/BackupManagerService.java
@@ -3390,6 +3390,14 @@
                                 break;
                         }
 
+                        // The path needs to be canonical
+                        if (info.path.contains("..") || info.path.contains("//")) {
+                            if (MORE_DEBUG) {
+                                Slog.w(TAG, "Dropping invalid path " + info.path);
+                            }
+                            okay = false;
+                        }
+
                         // If the policy is satisfied, go ahead and set up to pipe the
                         // data to the agent.
                         if (DEBUG && okay && mAgent != null) {