LuckSiege / LuckSiege/PictureSelector

能否收拢一下ps_file_paths.xml里配置的权限

Open
#2,853 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
13.6k
Forks
3.1k
PR merge metrics
No merged PRs in 30d

Description

#### 当前使用的版本是多少?
当前依赖版本3.11.0

## Describe the problem or provide an error log?
#### 描述问题或提供错误log?

ps_file_paths.xml配置中

对fileprovider的路径进行配置时,需要指定可以访问的子路径,防止任意沙盒文件被访问。
将配置变更为子路径后可以规避一些安全性问题。
建议修改一下。
谢谢。

Contributor guide

No contributing guide indexed for this repository

Research direction

Open ps_file_paths.xml and review the external-path and root-path entries named camera_photos. Determine the required camera file subdirectories, replace the empty paths with appropriately narrow paths, and verify that camera photo sharing still works without exposing arbitrary sandbox files.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java
Domain
mobile, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.