1476681 - Crash in android.os.FileUriExposedException: file:///storage/emulated/0/Download/fennec-63.0a1.multi.android-arm.apk exposed beyond app through Intent.getData() at android.os.StrictMode.onFileUriExposed(StrictMode.java)

Status: VERIFIED FIXED

(Firefox for Android Graveyard :: General, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-89b5ad1e-48ae-4288-b1e9-e5dc20180718.
=============================================================

android.os.FileUriExposedException: file:///storage/emulated/0/Download/fennec-63.0a1.multi.android-arm.apk exposed beyond app through Intent.getData()
	at android.os.StrictMode.onFileUriExposed(StrictMode.java:1978)
	at android.net.Uri.checkFileUriExposed(Uri.java:2371)
	at android.content.Intent.prepareToLeaveProcess(Intent.java:10247)
	at android.content.Intent.prepareToLeaveProcess(Intent.java:10201)
	at android.app.Instrumentation.execStartActivity(Instrumentation.java:1667)
	at android.app.ContextImpl.startActivity(ContextImpl.java:917)
	at android.app.ContextImpl.startActivity(ContextImpl.java:888)
	at android.content.ContextWrapper.startActivity(ContextWrapper.java:379)
	at org.mozilla.gecko.updater.Updater.applyUpdate(Updater.java:520)
	at org.mozilla.gecko.updater.Updater.applyUpdate(Updater.java:213)
	at org.mozilla.gecko.updater.UpdatesApplyService.onHandleWork(UpdatesApplyService.java:16)
	at android.support.v4.app.JobIntentService$CommandProcessor.doInBackground(JobIntentService.java:391)
	at android.support.v4.app.JobIntentService$CommandProcessor.doInBackground(JobIntentService.java:382)
	at android.os.AsyncTask$2.call(AsyncTask.java:333)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
	at java.lang.Thread.run(Thread.java:764)

There are 8 crashes (from 2 installation) in nightly 63 with buildid 20180717100050. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1407046.

[1] https://hg.mozilla.org/mozilla-central/rev?node=2c647187c1a2

Comment 1

[Jan Henning [:JanH]]

I did the other file URI patch, so I'll take this one as well.

Comment 2

[Jan Henning [:JanH]]

It seems like my changes from bug 1450449, which were intended to prevent this very problem, got lost during the refactoring for bug 1407046.

Comment 3

[Jan Henning [:JanH]]

Attachment: Bug 1476681 - Starting from Nougat, install updates via content:// URIs.

We download the update APK into the public downloads directory and normally the
only relevant app consuming that URI should be the system package installer, but
just to be safe we only switch usage from Nougat onward, too.

This patch had already landed as part of bug 1450449, but subsequently got
overwritten during the refactoring in bug 1407046.

Review commit: https://reviewboard.mozilla.org/r/257870/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/257870/

Comment 4

[Oana Horvath [:ohorvath]]

Can reproduce this crash and Bug 1476754(alternatively) by updating Nightly 2018-07-17 to the 07/18 build. Cannot install the update on these devices:
Google Pixel (Android 9)
Samsung Galaxy S8 (Android 8.0)

Doesn't reproduce on these lower Android versions:
HTC Desire 820 (Android 6.0.1)
Nokia 6 (Android 7.1.1)

Comment 5

[Oana Horvath [:ohorvath]]

Also, STR similar to Bug 1476606.
It looks like the blank pop-up described there it's the Nightly crash reporter, which can be seen better on a Samsung S8: https://www.screencast.com/t/vHHs2Hiwe.

Comment 6

[(inactive) Jim Chen [:jchen] [:darchons]]

Comment on attachment 8993064 [details]
Bug 1476681 - Starting from Nougat, install updates via content:// URIs.

https://reviewboard.mozilla.org/r/257870/#review265238

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fe3e4345a4a3
Starting from Nougat, install updates via content:// URIs. r=jchen

Comment 8

[Tiberius Oros[:tiberius_oros]]

https://hg.mozilla.org/mozilla-central/rev/fe3e4345a4a3

Comment 9

[Oana Horvath [:ohorvath]]

No more crashes on build updates. Also, the pop-up crash reporter doesn't appear anymore. 
Marking this as fixed. 
Google Pixel (Android 9)
Samsung Galaxy S8 (Android 8.0)