1868382 - Cannot open a pdf with Files or gmail apps

Status: RESOLVED FIXED

(GeckoView :: PDF Viewer, defect, P1)

Description

[Calixte Denizet (:calixte)]

When I try to open a pdf with a Pixel 7 pro from the Files app, Fenix returns a 404.
But it works when I try to open a pdf from Chrome.
I added some logging in:
https://searchfox.org/mozilla-central/source/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/ContentInputStream.java#115-132
and when the pdf is provided by Files (content://com.google.android.apps.nbu.files.provider...), isExported returns false, when it returns true when opened from Chrome (content://media/external/downloads/...).

Checking if the provider is exported is one of the mitigations proposed here:
https://developer.android.com/privacy-and-security/risks/content-resolver#mitigations_2
After reading this again and again, I can see that there is a "OR" between each possibility.
So here we want to be sure that the user granted the provider and consequently we don't need to check if it's exported.

:olivia, wdyt ?

Comment 1

[Calixte Denizet (:calixte)]

Attachment: Bug 1868382 - Check if a provider belongs to an allow-list if it isn't exported when reading pdfs in GV r=#geckoview-reviewers

Some Google apps which are files provider are exported or not, hence checking for
the exported flag is likely too restrictive.
We can only rely on having user agreement to read pdf files on Android devices.

Comment 2

[Sylvestre Ledru [:Sylvestre]]

[Tracking Requested - why for this release]: the feature isn't usable

I am sure Calixte will fix it quickly but I would like RM to be aware of this

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1864956

Comment 4

[Olivia Hall [:olivia]]

Thanks for the background!

After reading this again and again, I can see that there is a "OR" between each possibility.
So here we want to be sure that the user granted the provider and consequently we don't need to check if it's exported.

That makes sense to me too. I'll see if I can find the right reviewer since there are many implications too.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The bug is marked as tracked for firefox122 (nightly). However, the bug still has low severity.

:olivia, could you please increase the severity for this tracked bug? If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/638dd51545aa
Check if a provider belongs to an allow-list if it isn't exported when reading pdfs in GV r=geckoview-reviewers,owlish

Comment 7

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/638dd51545aa