From 09e138b51f36deeabaafbc7bf72144d8ca458aaa Mon Sep 17 00:00:00 2001
From: Joe Stein <joeaarons@gmail.com>
Date: Sat, 18 May 2019 14:22:37 +0200
Subject: [PATCH] Check SQLite3 magic bytes before import

---
 .../activity/ImportExportActivity.java        | 30 ++++++++++++++++++-
 core/src/main/res/values/strings.xml          |  1 +
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/app/src/main/java/de/danoeh/antennapod/activity/ImportExportActivity.java b/app/src/main/java/de/danoeh/antennapod/activity/ImportExportActivity.java
index e6c9c37cc..9795c1240 100644
--- a/app/src/main/java/de/danoeh/antennapod/activity/ImportExportActivity.java
+++ b/app/src/main/java/de/danoeh/antennapod/activity/ImportExportActivity.java
@@ -23,6 +23,7 @@ import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.channels.FileChannel;
+import java.util.Arrays;
 
 import de.danoeh.antennapod.R;
 import de.danoeh.antennapod.core.preferences.UserPreferences;
@@ -109,9 +110,14 @@ public class ImportExportActivity extends AppCompatActivity {
     }
 
     private void restoreFrom(Uri inputUri) {
-        File currentDB = getDatabasePath(PodDBAdapter.DATABASE_NAME);
         InputStream inputStream = null;
         try {
+            if (!validateDB(inputUri)) {
+                displayBadFileDialog();
+                return;
+            }
+
+            File currentDB = getDatabasePath(PodDBAdapter.DATABASE_NAME);
             inputStream = getContentResolver().openInputStream(inputUri);
             FileUtils.copyInputStreamToFile(inputStream, currentDB);
             displayImportSuccessDialog();
@@ -123,6 +129,28 @@ public class ImportExportActivity extends AppCompatActivity {
         }
     }
 
+    private static final byte[] SQLITE3_MAGIC = "SQLite format 3\0".getBytes();
+    private boolean validateDB(Uri inputUri) throws IOException {
+        try (InputStream inputStream = getContentResolver().openInputStream(inputUri)) {
+            byte[] magicBuf = new byte[SQLITE3_MAGIC.length];
+            if (inputStream.read(magicBuf) == magicBuf.length) {
+                return Arrays.equals(SQLITE3_MAGIC, magicBuf);
+            }
+        }
+
+        return false;
+    }
+
+    private void displayBadFileDialog() {
+        AlertDialog.Builder d = new AlertDialog.Builder(ImportExportActivity.this);
+        d.setMessage(R.string.import_bad_file)
+                .setCancelable(false)
+                .setPositiveButton(android.R.string.ok, ((dialogInterface, i) -> {
+                    // do nothing
+                }))
+                .show();
+    }
+
     private void displayImportSuccessDialog() {
         AlertDialog.Builder d = new AlertDialog.Builder(ImportExportActivity.this);
         d.setMessage(R.string.import_ok);
diff --git a/core/src/main/res/values/strings.xml b/core/src/main/res/values/strings.xml
index add2dfe14..a02247625 100644
--- a/core/src/main/res/values/strings.xml
+++ b/core/src/main/res/values/strings.xml
@@ -796,4 +796,5 @@
     <string name="notification_channel_playing_description">Allows to control playback. This is the main notification you see while playing a podcast.</string>
     <string name="notification_channel_error">Errors</string>
     <string name="notification_channel_error_description">Shown if something went wrong, for example if download or gpodder sync fails.</string>
+    <string name="import_bad_file">Invalid/corrupt file</string>
 </resources>