Content Provider Path Traversal

How Content Provider Path Traversal works

Improperly validated ContentProvider URIs can allow path traversal to read arbitrary files or expose private app data when using openFile/openAssetFile.

Content Provider Path Traversal in practice

Attempt Traversal via content Shell

adb shell content read --uri "content://com.example.provider/../../../../data/data/com.example.app/databases/app.db"

If data is returned, the provider fails to canonicalize and validate paths.

How to fix and prevent Content Provider Path Traversal

1. Canonicalize and validate
   • Resolve paths with File.getCanonicalPath() and enforce allow‑listed directories.
2. Enforce permissions
   • Require signature‑level permissions or READ/WRITE custom permissions; avoid grantUriPermissions broadly.
3. Use FileProvider
   • Prefer FileProvider with strict paths.xml to mediate file access safely.

Last updated 2025-11-22