🔄 Upstream Parity: keep media temp files private#698
Conversation
- Source: Ported from upstream openclaw android repo (commit d525d6486d) "fix(android): keep camera temp files private" by Vincent Koc. - Why: Fixes CodeQL local temp-file disclosure findings and improves reliability by explicitly providing `context.cacheDir` when using `File.createTempFile` for media captures instead of relying on the system default `java.io.tmpdir`. - Adaptation: Applied identically to `CameraCaptureManager` and `ScreenRecordManager` matching upstream implementations. - Excluded upstream behavior: None. - Verification: The project builds cleanly and all existing unit tests pass via `./gradlew app:testStandardDebugUnitTest`. Co-authored-by: yuga-hashimoto <74749461+yuga-hashimoto@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
d525d6486d305482906b974136b8d25395211709) "fix(android): keep camera temp files private" by Vincent Koc.context.cacheDirwhen usingFile.createTempFilefor camera and screen recording media captures, instead of relying on the system defaultjava.io.tmpdirwhich can be unreliable or insecure on certain Android OEM flavors.CameraCaptureManager.ktandScreenRecordManager.kt. Refactored the signature of the private extension functiontakeJpegWithExifinCameraCaptureManagerto accept the directory parameter from the caller, exactly mirroring the upstream approach../gradlew app:testStandardDebugUnitTestwith a dummygoogle-services.jsonsetup.PR created automatically by Jules for task 4786848789865880393 started by @yuga-hashimoto