🔒 [security fix] Use FileProvider to share diagnostic report - #199
🔒 [security fix] Use FileProvider to share diagnostic report#199alvin000009238 wants to merge 1 commit into
Conversation
Co-authored-by: alvin000009238 <107313913+alvin000009238@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the diagnostic sharing feature on Android by writing the diagnostic text to a temporary file and sharing it as a file stream using a FileProvider, rather than passing it as raw text. Feedback was provided to explicitly set the URI in the intent's clipData to ensure that the receiving application is reliably granted read permissions across different Android versions.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| val intent = Intent(Intent.ACTION_SEND).apply { | ||
| type = "text/plain" | ||
| putExtra(Intent.EXTRA_SUBJECT, "CLHS Score 診斷包") | ||
| putExtra(Intent.EXTRA_TEXT, text) | ||
| putExtra(Intent.EXTRA_STREAM, uri) | ||
| addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION) | ||
| } |
There was a problem hiding this comment.
When sharing a file URI via Intent.ACTION_SEND and Intent.EXTRA_STREAM, setting FLAG_GRANT_READ_URI_PERMISSION alone is often not sufficient on many Android versions. The system grants URI permissions automatically only to the URI in the intent's data field or its clipData. Since ACTION_SEND uses EXTRA_STREAM instead of data, you should explicitly set the URI in clipData to ensure the receiving application is granted read permissions properly.
| val intent = Intent(Intent.ACTION_SEND).apply { | |
| type = "text/plain" | |
| putExtra(Intent.EXTRA_SUBJECT, "CLHS Score 診斷包") | |
| putExtra(Intent.EXTRA_TEXT, text) | |
| putExtra(Intent.EXTRA_STREAM, uri) | |
| addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION) | |
| } | |
| val intent = Intent(Intent.ACTION_SEND).apply { | |
| type = "text/plain" | |
| putExtra(Intent.EXTRA_SUBJECT, "CLHS Score 診斷包") | |
| putExtra(Intent.EXTRA_STREAM, uri) | |
| clipData = ClipData.newRawUri("", uri) | |
| addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION) | |
| } |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 25360d4db4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| val file = java.io.File(cachePath, "diagnostic_report.txt") | ||
| file.writeText(text) |
There was a problem hiding this comment.
Because every share overwrites the same diagnostic_report.txt, any app that was previously chosen for a diagnostic share can keep its temporary read grant to this stable FileProvider URI while its receive/share activity remains alive, and then read the contents of a later report that the user shares to someone else. This only affects users who generate/share multiple diagnostic reports before the earlier grant is revoked, but it undermines the intended per-share consent boundary; create a unique file/URI per report and clean up old files instead of reusing this filename.
Useful? React with 👍 / 👎.
🎯 What
Updated
DeveloperSettingsScreen.ktto share the diagnostic report via aFileProviderusingIntent.EXTRA_STREAMandFLAG_GRANT_READ_URI_PERMISSION, instead of passing the plain text inIntent.EXTRA_TEXT.Previously, the sensitive diagnostic text was passed directly within the intent's
EXTRA_TEXTfield. Because this was a broad implicit intent (ACTION_SENDwithtext/plain), any application on the user's device could register a receiver for this intent and potentially intercept the potentially sensitive diagnostic data silently in the background without user consent.🛡️ Solution
The diagnostic report is now written to a temporary file in the application's internal cache directory (
cacheDir/diagnostics). This file is then shared via aFileProvider. By doing so, the Android OS ensures that only the single application the user explicitly selects in the Chooser receives a temporary, revocableFLAG_GRANT_READ_URI_PERMISSIONto read the file. This completely eliminates the risk of interception by passive background applications, while fully preserving the user's ability to share the report to any app they choose.PR created automatically by Jules for task 6987226353436743643 started by @alvin000009238