Skip to content

Share intent: the log of a rejected uri contains the path and the file name #6948

Open

Description

@ToteMeiSter

Steps to reproduce

  1. In another app share a file to Talk so that the uri is rejected, e.g. an own FileProvider uri outside shared_attachments or a uri without content:// scheme.
  2. Open the exported app log.

Expected behaviour

The log tells that a share uri was rejected, but not which file it pointed to.

Actual behaviour

ConversationsListActivity.addFileToShareIfTrusted logs Rejecting untrusted uri from share intent: $uri:

Log.w(TAG, "Rejecting untrusted uri from share intent: $uri")

The full uri is written: path and query, so the file name of a file of another app, and a user id before the authority. The log can be exported and sent to a third party.

Nextcloud Talk app version

master (35c0d23c3)

Activity

  1. mahibi commented on Oct 26, 2026

    @mahibi
    Collaborator

    Thanks for contributing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions