The file provider is what grants app delegates (such as the camera app) access for reading and/or writing. It is what allows the camera intent to write it's image to the app's internal cache directory. The previous configuration allowed access to the entire cache directory which could be perceived as a security risk.
Using a sub-directory will at least isolate access to that specific directory and won't expose other cache files that the app may have stored. The chosen directory is something that should only be used by this plugin, and the directory will be mostly empty assuming that users call the cleanup API. Worst case scenario it may have images that was previously captured by the user.
Description
Update to provider to path to use a subdirectory, and updated the create code to use subdirectory.
Testing
Tested on using android simulator using getPicture API.
Paramedic tests also passes.
Checklist
[x] I've run the tests to see all new and existing tests pass
[x] I added automated test coverage as appropriate for this change
[x] Commit is prefixed with (platform) if this change only applies to one platform (e.g. (android))
Platforms affected
Android
Motivation and Context
The file provider is what grants app delegates (such as the camera app) access for reading and/or writing. It is what allows the camera intent to write it's image to the app's internal cache directory. The previous configuration allowed access to the entire cache directory which could be perceived as a security risk.
Using a sub-directory will at least isolate access to that specific directory and won't expose other cache files that the app may have stored. The chosen directory is something that should only be used by this plugin, and the directory will be mostly empty assuming that users call the
cleanupAPI. Worst case scenario it may have images that was previously captured by the user.Description
Update to provider to path to use a subdirectory, and updated the create code to use subdirectory.
Testing
Tested on using android simulator using
getPictureAPI. Paramedic tests also passes.Checklist
(platform)if this change only applies to one platform (e.g.(android))