TeamAmaze / TeamAmaze/AmazeFileManager
Opening file from SMB server leaks smb login password in the file path and fails to open file
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 6.4k
- Forks
- 1.7k
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 1
Description
Describe the bug
Say I'm opening a file in default browser from smb server folder. Normally opening a file with simple tap produces path like this 127.0.0.1:PORT/path, which works as expected. But if I open a file using "Open with" menu, it produces a path like this content://com.amaze...etc.../USERNAME:PASSWORD@IP/path , which leaks credentials to third party apps (eg: browser). As a result, file fails to open.
To Reproduce
Steps to reproduce the behavior:
- Open any folder from smb connection.
- Click menu icon of a file.
- Click 'Open With' option and select file format.
- Select an App to open the file.
Smartphone:
- Device: Redmi K30
- OS: Android 11
- Version: 3.6.1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue on Android 11 by opening an SMB file through the Open With flow and compare it with the normal tap flow. Trace how the content URI is constructed and verify that credentials are not passed to the selected app and that the file opens successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100