am e2adb1ff: Merge "Sanity-check paths of files to be restored" into jb-mr2-dev
* commit 'e2adb1ff4af09d66096df64461c80d4126ab2692':
Sanity-check paths of files to be restored
diff --git a/services/java/com/android/server/BackupManagerService.java b/services/java/com/android/server/BackupManagerService.java
index a537e99..2c88c32 100644
--- a/services/java/com/android/server/BackupManagerService.java
+++ b/services/java/com/android/server/BackupManagerService.java
@@ -3390,6 +3390,14 @@
break;
}
+ // The path needs to be canonical
+ if (info.path.contains("..") || info.path.contains("//")) {
+ if (MORE_DEBUG) {
+ Slog.w(TAG, "Dropping invalid path " + info.path);
+ }
+ okay = false;
+ }
+
// If the policy is satisfied, go ahead and set up to pipe the
// data to the agent.
if (DEBUG && okay && mAgent != null) {