Vulnerabitlity fix as per Termux report: https://termux.org/general/2…

…022/02/15/termux-apps-vulnerability-disclosures.html#termux-files-world-readable
simbadMarino · Apr 15, 2022 · 9af6548 · 9af6548
1 parent 57db214
commit 9af6548
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
@@ -189,11 +189,13 @@
         <receiver android:name="com.termux.app.TermuxOpenReceiver" />
 
 
-        <provider android:authorities="com.termux.files"
-            android:readPermission="android.permission.permRead"
+        <provider
+            android:name="com.termux.app.TermuxOpenReceiver$ContentProvider"
+            android:authorities="com.termux.files"
             android:exported="true"
             android:grantUriPermissions="true"
-            android:name="com.termux.app.TermuxOpenReceiver$ContentProvider" />
+            android:permission="com.termux.permission.RUN_COMMAND"
+             />
 
 
         <activity android:name="com.facebook.react.devsupport.DevSettingsActivity" />

diff --git a/android/app/src/main/java/com/termux/app/TermuxOpenReceiver.java b/android/app/src/main/java/com/termux/app/TermuxOpenReceiver.java
@@ -186,7 +186,7 @@ public ParcelFileDescriptor openFile(@NonNull Uri uri, @NonNull String mode) thr
             } catch (IOException e) {
                 throw new IllegalArgumentException(e);
             }
-            return ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY);
+            return ParcelFileDescriptor.open(file, ParcelFileDescriptor.parseMode(mode));
         }
     }