add back missing asset; handle path-travesal issue

Author: commonsguy

ContentProvider/Files/app/src/main/assets/test.pdf

@@ -49,7 +49,13 @@ public boolean onCreate() {
   @Override
   public ParcelFileDescriptor openFile(Uri uri, String mode)
                                                             throws FileNotFoundException {
-    File f=new File(getContext().getFilesDir(), uri.getPath());
+    File root=getContext().getFilesDir();
+    File f=new File(root, uri.getPath()).getAbsoluteFile();
+
+    if (!f.getPath().startsWith(root.getPath())) {
+      throw new
+        SecurityException("Resolved path jumped beyond root");
+    }
 
     if (f.exists()) {
       return(ParcelFileDescriptor.open(f, parseMode(mode)));

ContentProvider/Files/app/src/main/java/com/commonsware/android/cp/files/FileProvider.java

@@ -49,7 +49,13 @@ public boolean onCreate() {
   @Override
   public ParcelFileDescriptor openFile(Uri uri, String mode)
                                                             throws FileNotFoundException {
-    File f=new File(getContext().getFilesDir(), uri.getPath());
+    File root=getContext().getFilesDir();
+    File f=new File(root, uri.getPath()).getAbsoluteFile();
+
+    if (!f.getPath().startsWith(root.getPath())) {
+      throw new
+        SecurityException("Resolved path jumped beyond root");
+    }
 
     if (f.exists()) {
       return(ParcelFileDescriptor.open(f, parseMode(mode)));