2

I'm getting crashes in my app after my application expects an image onActivityResult, but receives something like a .pdf. I understand my code should do a check before it crashes to make sure the data passed back in is indeed an image, but I thought specifying a mime type would be enough.

My code:

// Show popup

Intent intent = new Intent();
intent.setType("image/*");
intent.setAction(Intent.ACTION_GET_CONTENT);
intent.addCategory(Intent.CATEGORY_OPENABLE);

This code makes dropbox, gallery, Google Drive, etc. to show up as options. But even Google Drive allows you to select a .pdf. Am I setting the type of the intent incorrectly? Am I stuck allowing the offending app to let the user choose a pdf or other file type?

2 Answers 2

0

Even if the system could validate the file extension for you, you still need to validate the data from the user. What if the [potentially malicious] user simply changes the .pdf to .jpg?

0

Yes that will happen. So you need to put a check inside your onActivityResult() where you get your image URI and check for extensions like .jpg, .png ,.jpeg etc... and then only you should import the file else show a Toast or Dialog.

3
  • You need to remember that file extensions are not authoritative, too.
    – dcow
    Jun 12, 2014 at 20:04
  • 1
    @dcow Then how can it be insured? Kindly enlighten. I'm keen to know this. Jun 12, 2014 at 20:05
  • well it depends on what you are doing with the data.
    – dcow
    Jun 12, 2014 at 20:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.