kuschelyagi/piecannon
1
0
Fork 0
Code Issues 5 Pull Requests Projects Releases Wiki Activity

android: implement better mechanism for generating filename from file uri, using jodd to map mime type to extension and using the file's extension if it has one (sometimes it does not)

Browse Source 
note that blindly trusting the name/extension of the file has security ramifications if you don't know what you are doing (and even if the extension is correct, e.g. if you upload a php file to a php enabled server). It is expected you know what you are doing since you have full control of the server.
This commit is contained in:
Adrian Kuschelyagi Malacoda 2020-10-30 04:55:17 -05:00
parent 51a2b89af1
commit 4be9bd83bf
2 changed files with 38 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
android/pom.xml
View File

@ -29,6 +29,11 @@
<artifactId>jsch</artifactId>
<version>0.1.55</version>
</dependency>
<dependency>
<groupId>org.jodd</groupId>
<artifactId>jodd-util</artifactId>
<version>6.0.0</version>
</dependency>
<dependency>
<groupId>com.google.code.gson</groupId>
<artifactId>gson</artifactId>

59
android/src/main/java/net/monarchpass/piecannon/Send.java
View File

@ -18,6 +18,8 @@ import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.ExecutionException;
import jodd.net.MimeTypes;
import lombok.AllArgsConstructor;
public class Send extends Activity {
@ -43,34 +45,24 @@ public class Send extends Activity {
text.setText(imageUri.toString());
final ContentResolver resolver = getContentResolver();
final String type = resolver.getType(imageUri);
String extension;
if ("image/gif".equals(type)) {
extension = ".gif";
} else if ("image/png".equals(type)) {
extension = ".png";
} else {
extension = ".jpg";
}
final String fileName = imageUri.getLastPathSegment() + extension;
final Server testServer = new TestServer();
try
{
final URI uploaded = executor.submit(() -> testServer.upload(fileName, new ContentByteSource(resolver, imageUri)))
.get();
text.setText(uploaded.toString());
shareUploadUrl(uploaded);
}
catch (final InterruptedException | ExecutionException exception) {
final StringWriter buf = new StringWriter();
final PrintWriter out = new PrintWriter(buf);
out.println("in: " + imageUri + " -> " + fileName);
exception.printStackTrace(out);
text.setText(buf.toString());
}
executor.submit(() -> {
try
{
final URI uploaded = testServer.upload(createFileNameForUri(imageUri, resolver), new ContentByteSource(resolver, imageUri));
runOnUiThread(() -> {
text.setText(uploaded.toString());
shareUploadUrl(uploaded);
});
}
catch (final Exception exception) {
final StringWriter buf = new StringWriter();
final PrintWriter out = new PrintWriter(buf);
exception.printStackTrace(out);
runOnUiThread(() -> text.setText(buf.toString()));
}
});
}
public void shareUploadUrl (final URI uploadedUrl) {
@ -80,6 +72,21 @@ public class Send extends Activity {
startActivity(Intent.createChooser(sharingIntent, "Share uploaded url"));
}
public static String createFileNameForUri (final Uri uri, final ContentResolver resolver) {
final String filename = uri.getLastPathSegment();
if (filename.contains(".")) {
return filename;
}
final String type = resolver.getType(uri);
final String[] extensions = MimeTypes.findExtensionsByMimeTypes(type, false);
if (extensions.length > 0) {
return filename + "." + extensions[0];
}
throw new RuntimeException("Could not construct a file name");
}
@AllArgsConstructor
public static class ContentByteSource extends ByteSource {
private final ContentResolver resolver;