diff --git a/app/src/main/java/eu/faircode/email/Log.java b/app/src/main/java/eu/faircode/email/Log.java index 6970f8ccc3..7642a1c321 100644 --- a/app/src/main/java/eu/faircode/email/Log.java +++ b/app/src/main/java/eu/faircode/email/Log.java @@ -247,8 +247,6 @@ public class Log { public static native void jni_safe_write(OutputStream os, byte[] data); - public static native Process jni_safe_runtime_exec(Runtime runtime, String[] cmd); - public static native long[] jni_safe_runtime_stats(); public static void setLevel(Context context) { @@ -3132,15 +3130,18 @@ public class Log { attachment.progress = 0; attachment.id = db.attachment().insertAttachment(attachment); + // https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html#java + ProcessBuilder pb = new ProcessBuilder("logcat", + "-d", + "-v", "threadtime", + //"-t", "1000", + Log.TAG + ":I"); + pb.directory(context.getFilesDir()); + Process proc = null; File file = attachment.getFile(context); try (OutputStream os = new BufferedOutputStream(new FileOutputStream(file))) { - String[] cmd = new String[]{"logcat", - "-d", - "-v", "threadtime", - //"-t", "1000", - Log.TAG + ":I"}; - proc = proc = jni_safe_runtime_exec(Runtime.getRuntime(), cmd); + proc = pb.start(); long size = 0; try (BufferedReader br = new BufferedReader(new InputStreamReader(proc.getInputStream()))) { diff --git a/app/src/main/jni/fairemail.cc b/app/src/main/jni/fairemail.cc index 219f2c3a45..b1576120e4 100644 --- a/app/src/main/jni/fairemail.cc +++ b/app/src/main/jni/fairemail.cc @@ -83,15 +83,6 @@ Java_eu_faircode_email_Log_jni_1safe_1write(JNIEnv *env, jclass clazz, env->CallVoidMethod(os, mid, data); } -extern "C" -JNIEXPORT jobject JNICALL -Java_eu_faircode_email_Log_jni_1safe_1runtime_1exec(JNIEnv *env, jclass clazz, - jobject runtime, jobjectArray cmd) { - jclass cls = env->FindClass("java/lang/Runtime"); - jmethodID mid = env->GetMethodID(cls, "exec", "([Ljava/lang/String;)Ljava/lang/Process;"); - return env->CallObjectMethod(runtime, mid, cmd); -} - extern "C" JNIEXPORT jlongArray JNICALL Java_eu_faircode_email_Log_jni_1safe_1runtime_1stats(JNIEnv *env, jclass clazz) {