Fix Refactor file path handling to use Path API

[odaysec]

General fix approach

When checking whether a user-supplied path is within a given directory, ensure you are comparing normalized Path objects or, if using strings, that directory paths are slash-terminated before using startsWith. In Java, Path#startsWith performs a component-wise check and avoids the partial-prefix issue.

Best concrete fix here

We only need to adjust Util.isAppSpecificStorageFileUri in Util.java. Currently it does:

String filePath = new File(uriPath).getCanonicalPath();
String internalAppDirectoryPath = activity.getFilesDir().getCanonicalPath();
@Nullable File externalAppDirectory = activity.getExternalFilesDir(/* type= */ null);
@Nullable
String externalAppDirectoryPath =
    externalAppDirectory == null ? null : externalAppDirectory.getCanonicalPath();
return filePath.startsWith(internalAppDirectoryPath)
    || (externalAppDirectoryPath != null && filePath.startsWith(externalAppDirectoryPath));

We will convert these to Path objects and use startsWith on normalized paths:

Path filePath = new File(uriPath).toPath().toRealPath();
Path internalAppDirectoryPath = activity.getFilesDir().toPath().toRealPath();
@Nullable File externalAppDirectory = activity.getExternalFilesDir(/* type= */ null);
@Nullable Path externalAppDirectoryPath =
    externalAppDirectory == null ? null : externalAppDirectory.toPath().toRealPath();
return filePath.startsWith(internalAppDirectoryPath)
    || (externalAppDirectoryPath != null && filePath.startsWith(externalAppDirectoryPath));

This keeps the original behavior (checking “inside app-specific internal or external storage”) but removes the partial-prefix issue. toRealPath() is roughly the Path equivalent of getCanonicalPath(), resolving symlinks and ...

We must add the necessary imports at the top of Util.java:

import java.nio.file.Path;
import java.nio.file.Paths;

(We actually only need Path; Paths is not strictly required, so we will only import Path.)

References

Partial Path Traversal
CVE-2022-23457: ESAPI Vulnerability Report