Fixed: Do not use files as icons that are non-regular files, are brok…

…en symlinks or their canonical path is not under the ~/.shortcuts/icons directory
termux · Sep 22, 2021 · 9df1ab7 · 9df1ab7
1 parent 13954b8
commit 9df1ab7
Show file tree

Hide file tree

Showing 3 changed files with 44 additions and 7 deletions.
diff --git a/app/build.gradle b/app/build.gradle
@@ -63,6 +63,7 @@ dependencies {
     implementation "org.reactivestreams:reactive-streams:1.0.3"
     implementation 'io.reactivex.rxjava2:rxjava:2.2.10'
 
+    implementation "androidx.annotation:annotation:1.2.0"
     implementation 'com.termux.termux-app:termux-shared:23b707a819'
 
     // Use if below libraries are published locally by termux-app with `./gradlew publishReleasePublicationToMavenLocal` and used with `mavenLocal()`.

diff --git a/app/src/main/java/com/termux/widget/TermuxCreateShortcutActivity.java b/app/src/main/java/com/termux/widget/TermuxCreateShortcutActivity.java
@@ -17,9 +17,12 @@
 import android.widget.ArrayAdapter;
 import android.widget.ListView;
 
+import androidx.annotation.Nullable;
+
 import com.termux.shared.data.DataUtils;
 import com.termux.shared.file.FileUtils;
 import com.termux.shared.file.TermuxFileUtils;
+import com.termux.shared.file.filesystem.FileType;
 import com.termux.shared.logger.Logger;
 import com.termux.shared.settings.preferences.TermuxWidgetAppSharedPreferences;
 import com.termux.shared.shell.ShellUtils;
@@ -146,8 +149,8 @@ private void createPinnedShortcut(Context context, String shortcutFilePath) {
         builder.setIntent(getExecutionIntent(context, shortcutFilePath));
         builder.setShortLabel(shortcutFileName);
 
-        File shortcutIconFile = getShortcutIconFile(shortcutFileName);
-        if (shortcutIconFile.exists())
+        File shortcutIconFile = getShortcutIconFile(context, shortcutFileName);
+        if (shortcutIconFile != null)
             builder.setIcon(Icon.createWithBitmap(((BitmapDrawable) Drawable.createFromPath(shortcutIconFile.getAbsolutePath())).getBitmap()));
         else
             builder.setIcon(Icon.createWithResource(context, R.drawable.ic_launcher));
@@ -164,8 +167,8 @@ private void createStaticShortcut(Context context, String shortcutFilePath) {
         intent.putExtra(Intent.EXTRA_SHORTCUT_INTENT, getExecutionIntent(context, shortcutFilePath));
         intent.putExtra(Intent.EXTRA_SHORTCUT_NAME, shortcutFileName);
 
-        File shortcutIconFile = getShortcutIconFile(shortcutFileName);
-        if (shortcutIconFile.exists())
+        File shortcutIconFile = getShortcutIconFile(context, shortcutFileName);
+        if (shortcutIconFile != null)
             intent.putExtra(Intent.EXTRA_SHORTCUT_ICON, ((BitmapDrawable) Drawable.createFromPath(shortcutIconFile.getAbsolutePath())).getBitmap());
         else
             intent.putExtra(Intent.EXTRA_SHORTCUT_ICON_RESOURCE, Intent.ShortcutIconResource.fromContext(context, R.drawable.ic_launcher));
@@ -184,9 +187,36 @@ private Intent getExecutionIntent(Context context, String shortcutFilePath) {
         return executionIntent;
     }
 
-    private File getShortcutIconFile(String shortcutFileName) {
-       return new File(TermuxConstants.TERMUX_SHORTCUT_SCRIPT_ICONS_DIR_PATH +
-                "/" + shortcutFileName + ".png");
+    @Nullable
+    private File getShortcutIconFile(Context context, String shortcutFileName) {
+        String errmsg;
+        String shortcutIconFilePath = FileUtils.getCanonicalPath(
+                TermuxConstants.TERMUX_SHORTCUT_SCRIPT_ICONS_DIR_PATH +
+                "/" + shortcutFileName + ".png", null);
+
+        FileType fileType = FileUtils.getFileType(shortcutIconFilePath, true);
+        //  Ensure file or symlink points to a regular file that exists
+        if (fileType != FileType.REGULAR) {
+            if (fileType != FileType.NO_EXIST) {
+                errmsg = context.getString(R.string.error_icon_not_a_regular_file, fileType.getName()) +
+                        "\n" + context.getString(R.string.msg_icon_absolute_path, shortcutIconFilePath);
+                Logger.logErrorAndShowToast(context, LOG_TAG, errmsg);
+            }
+            return null;
+        }
+
+        // Do not allow icons files not under TermuxConstants.TERMUX_SHORTCUT_SCRIPT_ICONS_DIR_PATH
+        if (!FileUtils.isPathInDirPath(shortcutIconFilePath, TermuxConstants.TERMUX_SHORTCUT_SCRIPT_ICONS_DIR_PATH, true)) {
+            errmsg = context.getString(R.string.error_icon_not_under_shortcut_icons_directory) +
+                    "\n" + context.getString(R.string.msg_icon_absolute_path, shortcutIconFilePath);
+            Logger.logErrorAndShowToast(context, LOG_TAG, errmsg);
+            return null;
+        }
+
+        Logger.logInfo(LOG_TAG, "Using file at \"" + shortcutIconFilePath + "\" as shortcut icon file");
+        Logger.showToast(context, "Using file at \"" + shortcutIconFilePath + "\" as shortcut icon file", true);
+
+        return new File(shortcutIconFilePath);
     }
 
 }
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
@@ -5,6 +5,7 @@
     <!ENTITY TERMUX_APP_NAME "Termux">
     <!ENTITY TERMUX_WIDGET_APP_NAME "Termux:Widget">
     <!ENTITY TERMUX_SHORTCUT_SCRIPTS_DIR_PATH_SHORT "~/.shortcuts/">
+    <!ENTITY TERMUX_SHORTCUT_SCRIPT_ICONS_DIR_PATH_SHORT "~/.shortcuts/icons">
     ]>
 
 <resources>EXTRA_SHORTCUT_INTENT
@@ -21,6 +22,7 @@
     <string name="msg_bad_token">This shortcut is invalid - remove and add again.</string>
     <string name="msg_executing_task">Executing task: \"%1$s\"</string>
     <string name="msg_executable_absolute_path">Executable Absolute Path: \"%1$s\"</string>
+    <string name="msg_icon_absolute_path">Icon Absolute Path: \"%1$s\"</string>
     <string name="msg_request_create_pinned_shortcut">Requesting to create pinned shortcut for \"%1$s\"</string>
     <string name="msg_request_create_static_shortcut">Requesting to create static shortcut for \"%1$s\"</string>
 
@@ -29,6 +31,10 @@
     <string name="error_null_or_empty_executable">The executable is null or empty.</string>
     <string name="error_executable_not_under_shortcuts_directory">An executable can only be
         executed if its under the &TERMUX_SHORTCUT_SCRIPTS_DIR_PATH_SHORT; directory.</string>
+    <string name="error_icon_not_under_shortcut_icons_directory">The icon is not under the
+        &TERMUX_SHORTCUT_SCRIPT_ICONS_DIR_PATH_SHORT; directory.</string>
+    <string name="error_icon_not_a_regular_file">The icon file is not a regular file but is instead
+        a \"%1$s\".</string>
     <string name="error_create_pinned_shortcut_failed">Failed to create pinned shortcut for \"%1$s\"</string>
     <string name="error_create_static_shortcut_failed">Failed to create static shortcut for \"%1$s\"</string>