From 9dffe99d209ab61d768bfd3f46f55f43cea466b5 Mon Sep 17 00:00:00 2001
From: Calder Kitagawa <[email protected]>
Date: Mon, 19 Oct 2026 09:04:13 -0700
Subject: [PATCH] [Android] Consistently extract absolute file paths in SelectFileDialog

GetDisplayNameTask previously extracted file: URI paths via
Uri.getSchemeSpecificPart(), whereas single-file selection in
onIntentCompleted() uses Uri.getPath(). Aligning GetDisplayNameTask on
Uri.getPath() and requiring an absolute path in resolveRegularFilePath()
ensures non-hierarchical and relative file: URIs are rejected
consistently before path canonicalization.

Fixed: 574803484
Change-Id: I97cb96f43dcda41065c71fef8a78a4c86a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8611108
Auto-Submit: Calder Kitagawa <[email protected]>
Reviewed-by: Sky Malice <[email protected]>
Commit-Queue: Calder Kitagawa <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1722015}
---
diff --git a/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java b/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java
index 56e80f4..fa1e565 100644
--- a/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java
+++ b/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java
@@ -1028,11 +1028,12 @@
     }
 
     /**
-     * Canonicalises a caller-supplied file path with realpath() and returns it only if it names an
-     * existing regular file that is not in procfs. Returns null otherwise.
+     * Canonicalises a caller-supplied file path with realpath() and returns it only if it is an
+     * absolute path that names an existing regular file that is not in procfs. Returns null
+     * otherwise.
      */
-    private static @Nullable String resolveRegularFilePath(String path) {
-        if (TextUtils.isEmpty(path)) return null;
+    private static @Nullable String resolveRegularFilePath(@Nullable String path) {
+        if (TextUtils.isEmpty(path) || !path.startsWith("/")) return null;
         String resolved = FileUtils.getAbsoluteFilePath(path);
         // Reject paths such as /proc/self/maps that resolve into procfs.
         if (resolved.isEmpty() || resolved.startsWith("/proc/") || !new File(resolved).isFile()) {
@@ -1401,12 +1402,17 @@
                     // device was observed to return a file:// URI instead, so convert if necessary.
                     // See https://crbug.com/752834 for context.
                     if (ContentResolver.SCHEME_FILE.equals(mUris[i].getScheme())) {
+                        // Only hierarchical file:///path URIs are acceptable here. An opaque
+                        // file: URI such as "file:content://authority/path" has no path, and its
+                        // scheme-specific part is a bare content URI that native would open
+                        // through ContentResolver, bypassing the content URI checks below.
+                        //
                         // Resolve the path *once* (realpath, follows /proc/self/fd/N magic
                         // links and symlinks) and forward the resolved path instead of the
                         // caller-supplied alias, so that later opens by the browser cannot be
                         // redirected to a different file. Reject anything that does not
                         // resolve to an existing regular file outside the app data dir.
-                        String resolved = resolveRegularFilePath(mUris[i].getSchemeSpecificPart());
+                        String resolved = resolveRegularFilePath(mUris[i].getPath());
                         if (resolved == null || isPathUnderAppDir(resolved, mContext)) {
                             return null;
                         }
diff --git a/ui/android/junit/src/org/chromium/ui/base/SelectFileDialogTest.java b/ui/android/junit/src/org/chromium/ui/base/SelectFileDialogTest.java
index 81999f05..2f4adf3 100644
--- a/ui/android/junit/src/org/chromium/ui/base/SelectFileDialogTest.java
+++ b/ui/android/junit/src/org/chromium/ui/base/SelectFileDialogTest.java
@@ -1219,6 +1219,75 @@
     }
 
     @Test
+    @DisableFeatures({UiAndroidFeatures.CHECK_INTENT_CALLER_PERMISSION})
+    public void testFileSchemeRejectsOpaqueAndRelativeUris() throws IOException {
+        File validFile = mTempFolder.newFile("valid.jpg");
+
+        // Even if realpath() were to resolve a non-hierarchical or relative path to an existing
+        // regular file, opaque file: URIs (such as "file:content://...") and relative paths must
+        // be rejected before reaching FileUtils.getAbsoluteFilePath().
+        Mockito.lenient()
+                .doReturn(validFile.getCanonicalPath())
+                .when(mFileUtilsMocks)
+                .getAbsoluteFilePath(any());
+
+        SelectFileDialog selectFileDialog = new SelectFileDialog(0);
+        Uri[] opaqueAndRelativeUris =
+                new Uri[] {
+                    Uri.parse("file:content://com.android.chrome.FileProvider/images/pic.jpg"),
+                    Uri.parse("FILE:content://com.android.chrome.FileProvider/images/pic.jpg"),
+                    Uri.parse("file:valid.jpg"),
+                    Uri.fromParts("file", "valid.jpg", null),
+                };
+        for (Uri uri : opaqueAndRelativeUris) {
+            SelectFileDialog.GetDisplayNameTask task =
+                    selectFileDialog
+                    .new GetDisplayNameTask(
+                            ContextUtils.getApplicationContext(),
+                            /* isMultiple= */ false,
+                            new Uri[] {uri});
+            assertEquals("Expected null for " + uri, null, task.doInBackground());
+        }
+
+        SelectFileDialog.FilePathSelectedTask relativePathTask =
+                selectFileDialog
+                .new FilePathSelectedTask(ContextUtils.getApplicationContext(), "valid.jpg", null);
+        assertFalse(relativePathTask.doInBackground());
+
+        // End-to-end onIntentCompleted checks with opaque file:content:// URI in ClipData and data.
+        TestSelectFileDialog testDialog = new TestSelectFileDialog(0);
+        Uri opaqueContentUri =
+                Uri.parse("file:content://com.android.chrome.FileProvider/images/pic.jpg");
+        Intent clipIntent = new Intent();
+        clipIntent.setClipData(
+                new ClipData("label", new String[0], new ClipData.Item(opaqueContentUri)));
+        testDialog.onIntentCompleted(Activity.RESULT_OK, clipIntent);
+        runAllAsyncTasks();
+        assertEquals(0, testDialog.mFileSelectionSuccess);
+        assertEquals(1, testDialog.mFileSelectionAborted);
+        testDialog.resetFileSelectionAttempts();
+
+        Intent dataIntent = new Intent(Intent.ACTION_VIEW, opaqueContentUri);
+        testDialog.onIntentCompleted(Activity.RESULT_OK, dataIntent);
+        runAllAsyncTasks();
+        assertEquals(0, testDialog.mFileSelectionSuccess);
+        assertEquals(1, testDialog.mFileSelectionAborted);
+        testDialog.resetFileSelectionAttempts();
+        Mockito.verify(mFileUtilsMocks, Mockito.never()).getAbsoluteFilePath(any());
+
+        // Valid hierarchical file:/// URI still succeeds.
+        SelectFileDialog.GetDisplayNameTask validTask =
+                selectFileDialog
+                .new GetDisplayNameTask(
+                        ContextUtils.getApplicationContext(),
+                        /* isMultiple= */ false,
+                        new Uri[] {Uri.fromFile(validFile)});
+        assertTrue(validTask.doInBackground() != null);
+        Mockito.verify(mFileUtilsMocks).getAbsoluteFilePath(validFile.getPath());
+        assertEquals(validFile.getCanonicalPath(), validTask.mFilePaths[0]);
+    }
+
+    @Test
     public void testShowTypes() {
         ShadowMimeTypeMap shadowMimeTypeMap = Shadows.shadowOf(MimeTypeMap.getSingleton());
         shadowMimeTypeMap.addExtensionMimeTypeMapping("jpg", "image/jpeg");