Combination of content provider allows private data disclosure

How it was found

Good afternoon.

Sorry, its me again .. I use NC on a daily basis so I often makes some checks ..

As per #489105, document thumbnail shall not be disclosed. The exposure on thumbnailCache/ is an already know issue. However, malicious apps are still able to extract (at least) pictures and text files by combining two content provider results.

As discussed in #518669, file status is exposed. This allow basically any app to retreive NC storage file structures. The following endpoint is the relevant one for current issue: adb shell content query --uri content://org.nextcloud/file

which output for instance

By using the output from this content provider query, it is possible to force the DiskLruImageCacheFileProvider content provider to generate thumbnail of the assets adb shell content read --uri content://org.nextcloud.imageCache.provider/1553357105332.jpg

Impact

User data is exposed to partial disclosure (thumbnail).

As far as I understand, DiskLruImageCacheFileProvider shall not be exported