CVE-2023-5321: Missing Authorization (CWE-862)
value: Missing Authorization in GitHub repository hamza417/inure prior to build94.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.5
Published: 2023-09-30T14:15Z
Repository: https://github.com/hamza417/inure
Language: Kotlin
Files changed: app/src/main/assets/html/changelogs.html, app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
Commit date: 2023-09-30 19:08:53 +0530
Commit message: Patched improper input validation vulnerability

FLAGS:
   - skip build apk

Diff: diff --git a/app/src/main/assets/html/changelogs.html b/app/src/main/assets/html/changelogs.html
index 2bceaf69d..438c10da5 100644
--- a/app/src/main/assets/html/changelogs.html
+++ b/app/src/main/assets/html/changelogs.html
@@ -26,10 +26,14 @@
     <li>Fixed apps getting added multiple times in a tag.</li>
     <li>Fixed a lot of issues with <b>Batch Extract</b>.</li>
     <li>Fixed audio player position skipping playback issue.</li>
     <li>Fixed WebView losing scroll state on rotation.</li>
 </ul>
+<h4>Security</h4>
+<ul>
+    <li>Patched <i>Improper Input Validation</i>.</li>
+</ul>
 <h4>Improvements</h4>
 <ul>
     <li>Optimized text loader frameworks for better text rendering.</li>
     <li>Optimized image loader framework for even smoother animation execution when image caching is
         enabled.
diff --git a/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt b/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
index 9caf2baac..2e9e7ab4e 100644
--- a/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
+++ b/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
@@ -1,23 +1,23 @@
 package app.simple.inure.activities.association
 
+import android.annotation.SuppressLint
 import android.os.Bundle
 import android.util.Log
 import app.simple.inure.R
 import app.simple.inure.extensions.activities.BaseActivity
 import app.simple.inure.ui.association.Text
 import app.simple.inure.util.ConditionUtils.invert
+import app.simple.inure.util.NullSafety.isNotNull
 import app.simple.inure.util.NullSafety.isNull
 
 class TextViewerActivity : BaseActivity() {
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         setContentView(R.layout.activity_main)
 
-        Log.d("TextViewerActivity", "onCreate: ${intent.data?.path}")
-
         if (savedInstanceState.isNull()) {
             if (hasAppPath().invert()) {
                 supportFragmentManager.beginTransaction()
                     .replace(R.id.app_container, Text.newInstance())
                     .commit()
@@ -25,9 +25,18 @@ class TextViewerActivity : BaseActivity() {
                 showWarning("ERR: illegal action detected.")
             }
         }
     }
 
+    @SuppressLint("SdCardPath")
     private fun hasAppPath(): Boolean {
-        return intent.data?.path?.contains("data/data/$packageName")!!
+        if (intent.data.isNotNull()) {
+            val appDataPath = "/data/data/$packageName/"
+            val normalizedIntentPath = intent.data?.path?.replace("//+".toRegex(), "/") // Normalize multiple slashes
+            Log.d("TAG", "hasAppPath: $appDataPath")
+            Log.d("TAG", "hasAppPath: $normalizedIntentPath")
+            return normalizedIntentPath?.contains(appDataPath) == true
+        }
+
+        return false
     }
 }

Vulnerable code:         Log.d("TextViewerActivity", "onCreate: ${intent.data?.path}")

        return intent.data?.path?.contains("data/data/$packageName")!!
Fixed code: <h4>Security</h4>
<ul>
    <li>Patched <i>Improper Input Validation</i>.</li>
</ul>
import android.annotation.SuppressLint
import app.simple.inure.util.NullSafety.isNotNull
    @SuppressLint("SdCardPath")
        if (intent.data.isNotNull()) {
            val appDataPath = "/data/data/$packageName/"
            val normalizedIntentPath = intent.data?.path?.replace("//+".toRegex(), "/") // Normalize multiple slashes
            Log.d("TAG", "hasAppPath: $appDataPath")
            Log.d("TAG", "hasAppPath: $normalizedIntentPath")
            return normalizedIntentPath?.contains(appDataPath) == true
        }

        return false