8

Greetings stackoverflow.

Recently, I'm tracing the Bluetooth operating mechanism in Android framework. I've notice that there's some file type limitation which is made by this patch while receiving files via OPP.

in package com.android.bluetooth.opp , there's a fixed white list in Constants.java

/**
 * The MIME type(s) of we could accept from other device.
 * This is in essence a "white list" of acceptable types.
 * Today, restricted to images, audio, video and certain text types.
 */
public static final String[] ACCEPTABLE_SHARE_INBOUND_TYPES = new String[] {
    /* ... some types such as images and music ... */
};

which limits the acceptable file types in BluetoothOppObexServerSession.java

        // Reject policy: anything outside the "white list" plus unspecified
        // MIME Types.
        if (!pre_reject
            && (mimeType == null || (!Constants.mimeTypeMatches(mimeType,
                    Constants.ACCEPTABLE_SHARE_INBOUND_TYPES)))) {
        if (D) Log.w(TAG, "mimeType is null or in unacceptable list, reject the transfer");
        pre_reject = true;
        obexResponse = ResponseCodes.OBEX_HTTP_UNSUPPORTED_TYPE;

What makes us concern about the MIME type in this situation? In my knowledge, we may like to block the executable files (i.e. *.apk, *.so) since those files may harm our device. If blocking some specific types is the reason we set a list here, why would we use a white list instead of a black list just before this patch? Is there some similar limitation when we transmit files via other non-bluetooth protocol such as HTTP?

Will Norris
  • 542
  • 2
  • 8
coldturnip
  • 143
  • 2
  • 5

2 Answers2

2

OBEX profile is expected to achieve application level interoperability for the content formats being exchanged. For example if a business card is pushed / pulled the local application should understand the business card format to be able to display the business card at the appropriate location (example the contacts location) and should understand the format to display it in its local contacts app. OPP specifies content formats for Phone books (vCards) Calendar, Messaging, Notes, etc. So the server should support the particular object format that the client is trying to send it to be able to take appropriate action with the received object.

For a more generic transfer / exchange of files the FTP profile can be used.

Dennis Mathews
  • 6,897
  • 2
  • 26
  • 39
0

I voted your question up and marked it as non-constructive at the same time. The question is great but it's asked in the wrong place: you need to file your complaint as a bug/suggestion in android bug tracker.

To answer your question - it's a tendency of not letting the user shoot himself in the foot by restricting his access to a both a gun and a his own foot. Maybe custom ROMs are free from this limitation.

Eugene Mayevski 'Callback
  • 45,135
  • 8
  • 71
  • 121