LuckSiege / LuckSiege/PictureSelector
能否收拢一下ps_file_paths.xml里配置的权限
Open
- Dominant language
- Java
- Stars
- 13.6k
- Forks
- 3.1k
- PR merge metrics
- No merged PRs in 30d
Description
#### 当前使用的版本是多少?
当前依赖版本3.11.0
## Describe the problem or provide an error log?
#### 描述问题或提供错误log?
ps_file_paths.xml配置中
对fileprovider的路径进行配置时,需要指定可以访问的子路径,防止任意沙盒文件被访问。
将配置变更为子路径后可以规避一些安全性问题。
建议修改一下。
谢谢。
Contributor guide
No contributing guide indexed for this repository
Research direction
Open ps_file_paths.xml and review the external-path and root-path entries named camera_photos. Determine the required camera file subdirectories, replace the empty paths with appropriately narrow paths, and verify that camera photo sharing still works without exposing arbitrary sandbox files.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100