Prevent command line pollution from allowing privilege escalation

See matching commit in su-binary repo

Author: ChainsDD

src/com/noshufou/android/su/provider/PermissionsProvider.java

@@ -456,7 +456,7 @@ private boolean ensureDb() {
 
     private class SuDbOpenHelper extends SQLiteOpenHelper {
         private static final String DATABASE_NAME = "su.db";
-        private static final int DATABASE_VERSION = 5;
+        private static final int DATABASE_VERSION = 6;
 
         SuDbOpenHelper(Context context) {
             super(context, DATABASE_NAME, null, DATABASE_VERSION);
@@ -513,7 +513,7 @@ public void onUpgrade(SQLiteDatabase db, int oldVersion, int newVersion) {
                 upgradeVersion = 4;
             }
 
-            if (upgradeVersion == 4) {
+            if (upgradeVersion <= 5) {
                 Cursor c = db.query(Apps.TABLE_NAME, null, null, null, null, null, null);
                 while (c.moveToNext()) {
                     Util.writeStoreFile(mContext,
@@ -524,7 +524,7 @@ public void onUpgrade(SQLiteDatabase db, int oldVersion, int newVersion) {
                 }
                 c.close();
                 mContext.deleteDatabase("permissions.sqlite");
-                upgradeVersion = 5;
+                upgradeVersion = 6;
             }
 
         }

src/com/noshufou/android/su/util/Util.java

@@ -795,10 +795,18 @@ public static boolean writeStoreFile(Context context, int uid, int execUid, Stri
         try {
             OutputStreamWriter out = new OutputStreamWriter(new FileOutputStream(
                     new File(storedDir.getAbsolutePath() + File.separator + fileName)));
+            switch (allow) {
+                case AllowType.ALLOW:
+                    out.write("allow\n");
+                    break;
+                case AllowType.DENY:
+                    out.write("deny\n");
+                    break;
+                default:
+                    out.write("prompt\n");
+            }
             out.write(cmd);
             out.write('\n');
-            out.write(String.valueOf(allow));
-            out.write('\n');
             out.flush();
             out.close();
         } catch (FileNotFoundException e) {
@@ -819,14 +827,8 @@ public static boolean writeDefaultStoreFile(Context context) {
         String action = prefs.getString(Preferences.AUTOMATIC_ACTION, "prompt");
         try {
             OutputStreamWriter out = new OutputStreamWriter(new FileOutputStream(defFile.getAbsolutePath()));
-            out.write("default\n");
-            if (action.equals("allow")) {
-                out.write("1");
-            } else if (action.equals("deny")) {
-                out.write("0");
-            } else {
-                out.write("-1");
-            }
+            out.write(action);
+            out.write("\n");
             out.flush();
             out.close();
         } catch (FileNotFoundException e) {