Hello,
I got this email from google and all my apps are concerned :
_Hello Google Play Developer,
We’re writing to let you know that the apps listed at the end of this email have an unsafe path traversal issue which can allow a malicious app to access any file accessible to your app.
What’s happening
Starting January 16th, 2018, Google Play will block publishing of any new apps or updates that contain this path traversal vulnerability. Your published APK version will remain unaffected, however any updates to the app will be blocked unless you address this vulnerability.
Action required
There are two recommended strategies for eliminating a path traversal vulnerability in a ContentProvider._
-
If your ContentProvider does not need to be exposed to other apps:
- You can modify the tag of the affected ContentProvider in your Manifest to set android:exported=“false”. This will prevent other apps from sending Intents to the affected ContentProvider.
- You can also set the android:permission attribute to be a permission with android:protectionLevel=“signature” to prevent apps written by other developers from sending Intents to the affected ContentProvider.
-
If your ContentProvider needs to be exposed to other apps:
- You must correctly ensure that inputs to openFile that contain path traversal characters cannot cause your app to return unexpected files. You can do this by checking the file’s canonical path.
_Implementations of openFile in exported ContentProviders can be vulnerable if they don’t properly validate incoming Uri parameters. A malicious app can supply a crafted Uri (for example, one that contains “/…/”) to trick your app into returning a ParcelFileDescriptor for a file outside of the intended directory, which allows the malicious app to access any file accessible to your app.
Next steps _
- Update your app using the steps highlighted above.
- Sign in to your Play Console and submit the updated version of your app.
- Check back after five hours. We’ll show a warning message if the app hasn’t been updated correctly.
_ We’re here to help
For clarification on steps you need to take to resolve this issue, you can contact our developer support team._
I don’t really understand what I must modify in my code…