CVE-2025-32323 AI-generated analysis
platform/packages/apps/DocumentsUI, Storage Access Framework picker (ACTION_OPEN_DOCUMENT_TREE confirmation dialog, Shared/ConfirmFragment)
DocumentsUI now sanitizes the calling app's label in Shared.getCallingAppName with TextUtils.makeSafeForPresentation (500-character limit, TRIM and SINGLE_LINE flags) and puts the name in double quotes in the open_tree_dialog_message string. This stops the label from reading as part of the folder-access confirmation text.
Root cause
Shared.getCallingAppName(Activity) in src/com/android/documentsui/base/Shared.java returned PackageManager.getApplicationLabel(ai).toString() unchanged. Only an empty label fell back to R.string.anonymous_application. Labels of any length and with any characters, including newlines, were passed through. According to the commit message, the name is presented in the ConfirmFragment. The open_tree_dialog_title and open_tree_dialog_message strings both contain an appName placeholder, and the message string placed the name inline in the sentence ("This will let <appName> access current and future content stored in <dir>."), so the label could read as a continuation of the dialog text.
How the fix works
- src/com/android/documentsui/base/Shared.java:getCallingAppName: the return type changes from String to CharSequence. After the empty-label check, the label goes through TextUtils.makeSafeForPresentation(result.toString(), 500, 0, SAFE_STRING_FLAG_TRIM | SAFE_STRING_FLAG_SINGLE_LINE). Per the new test, this caps the label at 500 characters and turns a newline into a space. Static imports for the two flags are added.
- res/values/strings.xml:open_tree_dialog_message: the %1$s appName placeholder is now in double quotes. open_tree_dialog_title is unchanged.
- src/com/android/documentsui/dirlist/DocumentsAdapter.java:Environment, DirectoryFragment.java:AdapterEnvironment, tests/common/.../TestEnvironment.java: the unused getCallingAppName() interface method and its two implementations are removed. The commit message describes this as cleanup to avoid false positives when looking for callers of the Shared function.
- tests/unit/com/android/documentsui/picker/ApplicationNameTest.kt (new): a parameterized test of Shared.getCallingAppName that covers a normal label, a label with a newline (expected 'label label'), a 600-character label (expected to be cut to 500) and an empty label (expected the anonymous string).
Completeness
- The sanitization is applied inside the Shared.getCallingAppName helper, so every caller gets the sanitized value. The callers themselves (such as ConfirmFragment) are not shown in the material.
- Only open_tree_dialog_message gets quotation marks. open_tree_dialog_title ("Allow %1$s to access files in %2$s?", CHAR_LIMIT=80) still inserts the name without quotes and still accepts a label of up to 500 characters.
- The 500-character cap and the SINGLE_LINE flag limit length and line structure but do not otherwise restrict content (no SAFE_STRING_FLAG_FIRST_LINE; ellipsizeDip is 0). The material does not show whether 500 characters is short enough for the dialog layout.
- The material does not show any other DocumentsUI code that renders a third-party app label without going through Shared.getCallingAppName, and this commit does not change any.
Behavior changes
- Application labels longer than 500 characters are cut to 500, newlines are replaced so the name stays on one line, and leading and trailing whitespace is trimmed.
- The dialog message now shows the app name in double quotes.
- Shared.getCallingAppName now returns CharSequence instead of String. Fork code that assigns the result to a String needs to be adjusted.
- DocumentsAdapter.Environment no longer declares getCallingAppName(). A downstream Environment implementation that overrides it will not compile until the @Override is removed.
Per major
- Android 14: same fix: commit 1259beab2b8f in android-security-14.0.0_r22 (strings.xml quotes, Shared.getCallingAppName sanitization, Environment cleanup, new test). 7/8 lines of the patched region are present at android-security-14.0.0_r29.
- Android 15: same fix: commit f0336ada165f in android-security-15.0.0_r10. Same changes; strings.xml and DirectoryFragment differ only by line offsets. 7/8 lines present at android-security-15.0.0_r17.
- Android 16: same fix: commit 35a75b245508 in android-security-16.0.0_r1. Same logic, but the Shared.java pre-image is different (extra RESTRICT_STORAGE_ACCESS_FRAMEWORK import, different offsets). 7/8 lines present at android-security-16.0.0_r8.
- Android 17: not affected (not listed by the bulletin). 4/8 lines of the patched region are present at android-security-17.0.0_r1. The material does not show how the label is handled there.
Unknowns
- The ConfirmFragment code that uses Shared.getCallingAppName and renders the dialog is not in the material, so the exact rendering path and any other callers are not shown.
- Why the bulletin rates this as EoP is not explained beyond the commit message's description of the label reading as a continuation of the dialog text.
- Whether localized open_tree_dialog_message strings get the quotation marks is not shown.
- The state of the corresponding code on Android 17 (4/8 patched lines present) and on Android 13, which the bulletin lists as affected but for which no commit is provided.