不當對 FileProvider 揭露目錄
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
OWASP 類別：MASVS-STORAGE：儲存空間
總覽
設定不當的 FileProvider 可能會意外向攻擊者曝露檔案和目錄。根據設定不同，攻擊者可能因而得以讀取或寫入這些檔案，導致機密資訊外洩；甚至在最糟的情況下，攻擊者可能會執行任何程式碼。舉例來說，如果應用程式的設定中已配置 <root-path>，攻擊者就可以存取資料庫中存放的機密資訊，或是覆寫應用程式的原生資料庫，從而執行任何程式碼。
影響
影響因設定和檔案內容而異，但這類問題一般都會導致資料外洩 (檔案遭讀取) 或檔案遭到覆寫 (檔案遭寫入)。
因應措施
不在設定中使用 <root-path> 路徑元素
<root-path> 對應至裝置的根目錄 (/)。若在設定中加入這個元素，就等於開放外人自由存取檔案和資料夾，包括應用程式的沙箱和 /sdcard 目錄，從而產生非常廣大的受攻擊面。
分享狹窄的路徑範圍
在路徑設定檔中，請避免分享 . 或 / 之類廣大的路徑範圍，因為這可能導致機密檔案不慎外洩。請務必只分享有限/狹窄的路徑範圍，並確保該路徑底下只有您要分享的檔案，以降低機密檔案外洩的風險。
採用安全設定的典型設定檔如下：
XML
<paths>
<files-path name="images" path="images/" />
<files-path name="docs" path="docs" />
<cache-path name="cache" path="net-export/" />
</paths>
檢查及驗證外部 URI
請驗證外部 URI (使用 content 配置)，確保這些 URI 未指向應用程式的本機檔案。這麼做可以防止意外洩漏資訊。
授予最低存取權限
content URI 可以同時具有讀取和寫入權限，請務必只授予最低必要權限。比如，如果「只有」讀取權限是必要權限，就只明確授予 FLAG_GRANT_READ_URI_PERMISSION。
個人識別資訊 (PII) 之類的機密資料不應儲存在應用程式容器和系統憑證儲存空間之外的地方，因此，除非您確認儲存/分享的資訊不是機密資訊，否則請勿使用 <external-path> 元素。
資源
這個頁面中的內容和程式碼範例均受《內容授權》中的授權所規範。Java 與 OpenJDK 是 Oracle 和/或其關係企業的商標或註冊商標。
上次更新時間：2024-01-05 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2024-01-05 (世界標準時間)。"],[],[],null,["# Improperly Exposed Directories to FileProvider\n\n\u003cbr /\u003e\n\n**OWASP category:** [MASVS-STORAGE: Storage](https://mas.owasp.org/MASVS/05-MASVS-STORAGE)\n\nOverview\n--------\n\nAn improperly configured `FileProvider` can unintentionally expose files and directories to an attacker. Depending on the configuration, an attacker can read from or write to these exposed files, which in turn can lead to the exfiltration of sensitive information or, in the worst case, arbitrary code execution. For example, an application with `\u003croot-path\u003e` set in the configuration could enable an attacker to access sensitive information stored in databases or to overwrite the application's native libraries, leading to arbitrary code execution.\n\nImpact\n------\n\nThe impact varies depending on the configuration and file content, but generally leads to data leakage (when reading) or overwriting (when writing) files.\n\nMitigations\n-----------\n\n### Do not use the \\\u003croot-path\\\u003e path element in the configuration\n\n`\u003croot-path\u003e` corresponds to the root directory of the device (`/`). Allowing this in the configuration provides arbitrary access to files and folders, including the app's sandbox and `/sdcard` directory, which offers a very broad attack surface to an attacker.\n\n### Share narrow path ranges\n\nIn the path configuration file, avoid sharing a broad path range like `.` or `/`. Doing so can lead to exposing sensitive files by mistake. Share only a limited/narrower path range and ensure only files you want to share are under this path. This will prevent exposing sensitive files by mistake.\n\nA typical configuration file with safer settings could look like this: \n\n### Xml\n\n \u003cpaths\u003e\n \u003cfiles-path name=\"images\" path=\"images/\" /\u003e\n \u003cfiles-path name=\"docs\" path=\"docs\" /\u003e\n \u003ccache-path name=\"cache\" path=\"net-export/\" /\u003e\n \u003c/paths\u003e\n\n### Check and validate the external URIs\n\nValidate the external URIs (using a `content` scheme) and ensure they are not pointing to your application's local files. This prevents any inadvertent information leak.\n\n### Grant minimum access permissions\n\nA [`content URI`](/guide/topics/providers/content-provider-basics#ContentURIs) can have both read and write access permissions. Ensure only the minimum required access permission is granted.\nFor example, if *only* read permission is required, then explicitly grant only [`FLAG_GRANT_READ_URI_PERMISSION`](/reference/android/content/Intent#FLAG_GRANT_READ_URI_PERMISSION).\n\n### Avoid usage of \\\u003cexternal-path\\\u003e for storing/sharing sensitive information\n\nSensitive data, like personally identifiable information (PII), should not be stored outside of the application container or system credential storage facilities. Thus, avoid the usage of the`\u003cexternal-path\u003e` element, unless you have explicitly verified that the information being stored/shared is not sensitive.\n\nResources\n---------\n\n- [FileProvider Documentation](/reference/androidx/core/content/FileProvider)\n\n- [Vulnerability on using \\\u003croot-path\\\u003e](https://hackerone.com/reports/876192)"]]
