Skip to content

🔄 Upstream Parity: keep media temp files private#698

Open
yuga-hashimoto wants to merge 1 commit into
mainfrom
upstream-temp-file-fix-4786848789865880393
Open

🔄 Upstream Parity: keep media temp files private#698
yuga-hashimoto wants to merge 1 commit into
mainfrom
upstream-temp-file-fix-4786848789865880393

Conversation

@yuga-hashimoto
Copy link
Copy Markdown
Owner

  • Source: Ported from upstream OpenClaw Android repository (commit d525d6486d305482906b974136b8d25395211709) "fix(android): keep camera temp files private" by Vincent Koc.
  • Why: Fixes CodeQL local temp-file disclosure findings and improves reliability by explicitly providing context.cacheDir when using File.createTempFile for camera and screen recording media captures, instead of relying on the system default java.io.tmpdir which can be unreliable or insecure on certain Android OEM flavors.
  • Adaptation: Applied the fix directly to CameraCaptureManager.kt and ScreenRecordManager.kt. Refactored the signature of the private extension function takeJpegWithExif in CameraCaptureManager to accept the directory parameter from the caller, exactly mirroring the upstream approach.
  • Excluded upstream behavior: None, fully ported the fix for both managers.
  • Verification: Built and verified changes. Passed the standard unit test suite via ./gradlew app:testStandardDebugUnitTest with a dummy google-services.json setup.

PR created automatically by Jules for task 4786848789865880393 started by @yuga-hashimoto

- Source: Ported from upstream openclaw android repo (commit d525d6486d) "fix(android): keep camera temp files private" by Vincent Koc.
- Why: Fixes CodeQL local temp-file disclosure findings and improves reliability by explicitly providing `context.cacheDir` when using `File.createTempFile` for media captures instead of relying on the system default `java.io.tmpdir`.
- Adaptation: Applied identically to `CameraCaptureManager` and `ScreenRecordManager` matching upstream implementations.
- Excluded upstream behavior: None.
- Verification: The project builds cleanly and all existing unit tests pass via `./gradlew app:testStandardDebugUnitTest`.

Co-authored-by: yuga-hashimoto <74749461+yuga-hashimoto@users.noreply.github.com>
@google-labs-jules
Copy link
Copy Markdown
Contributor

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant