diff --git a/app/src/main/java/cash/z/ecc/android/ui/profile/ProfileFragment.kt b/app/src/main/java/cash/z/ecc/android/ui/profile/ProfileFragment.kt index 2d64156..220681a 100644 --- a/app/src/main/java/cash/z/ecc/android/ui/profile/ProfileFragment.kt +++ b/app/src/main/java/cash/z/ecc/android/ui/profile/ProfileFragment.kt @@ -25,6 +25,7 @@ import kotlinx.coroutines.launch import okio.Okio import java.io.File import java.io.IOException +import java.lang.IllegalArgumentException class ProfileFragment : BaseFragment() { @@ -109,8 +110,14 @@ class ProfileFragment : BaseFragment() { private fun writeLogcat(): File? { try { - val outputFile = File("${ZcashWalletApp.instance.filesDir}/logs", "developer_log.txt") - val cmd = arrayOf("/bin/sh", "-c", "logcat -v time -d | grep \"@TWIG\" > ${outputFile.absolutePath}") + // Note: the /logs directory has been configured as a file provider under @xml/file_paths which allows the temporary sharing of this file + val outputFile = File("${ZcashWalletApp.instance.filesDir}/logs", "developer_log.txt").also { it.parentFile.mkdirs() } + if (!outputFile.parentFile.isDirectory) { + // addresses security finding in issue #121 + throw IllegalArgumentException("Invalid path: ${outputFile.parentFile}. Verify" + + " that the default files directory is not being manipulated.") + } + val cmd = arrayOf("/bin/sh", "-c", "logcat -v time -d | grep '@TWIG' > '${outputFile.absolutePath}'") Runtime.getRuntime().exec(cmd) return outputFile } catch (e: IOException) {