open_file icon indicating copy to clipboard operation
open_file copied to clipboard

Security: fileprovider allow access to all app files

Open itzikkle opened this issue 10 months ago • 0 comments

hi, after apk decompile, i see that the package gives access to all the files under app domain, since it uses "." Since the package add to the assembled manifest access to ALL files under the app, It makes a security vulnerability for the app.
All the files can be accesses by other apps, and its problematic policy. The problem, is that in the file_paths.xml, the package put “.” (access to all files). Can you please add something more restrictive (specific files/directories)?

**provider android:name="com.crazecoder.openfile.FileProvider" android:exported="false" android:authorities="com.fmr.meitavtradeapp.fileProvider.com.crazecoder.openfile" android:grantUriPermissions="true"> file_paths.xml:

**

itzikkle avatar Sep 04 '23 15:09 itzikkle