Security Exception (FilePicker.writeToFile)

[ashishkumar468]

Summary:
If Shared URI does not grant us the read permission (God Knows why would they do so, a Security exception is thrown while reading it)

Steps to reproduce:
I have not been able to reproduce it personally, followed from play console

System logs:

java.lang.RuntimeException: 
  at android.app.ActivityThread.performLaunchActivity (ActivityThread.java:3430)
  at android.app.ActivityThread.handleLaunchActivity (ActivityThread.java:3614)
  at android.app.servertransaction.LaunchActivityItem.execute (LaunchActivityItem.java:86)
  at android.app.servertransaction.TransactionExecutor.executeCallbacks (TransactionExecutor.java:108)
  at android.app.servertransaction.TransactionExecutor.execute (TransactionExecutor.java:68)
  at android.app.ActivityThread$H.handleMessage (ActivityThread.java:2199)
  at android.os.Handler.dispatchMessage (Handler.java:112)
  at android.os.Looper.loop (Looper.java:216)
  at android.app.ActivityThread.main (ActivityThread.java:7625)
  at java.lang.reflect.Method.invoke (Native Method)
  at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run (RuntimeInit.java:524)
  at com.android.internal.os.ZygoteInit.main (ZygoteInit.java:987)
Caused by: java.lang.SecurityException: 
  at android.os.Parcel.createException (Parcel.java:1953)
  at android.os.Parcel.readException (Parcel.java:1921)
  at android.database.DatabaseUtils.readExceptionFromParcel (DatabaseUtils.java:183)
  at android.database.DatabaseUtils.readExceptionWithFileNotFoundExceptionFromParcel (DatabaseUtils.java:146)
  at android.content.ContentProviderProxy.openTypedAssetFile (ContentProviderNative.java:698)
  at android.content.ContentResolver.openTypedAssetFileDescriptor (ContentResolver.java:1476)
  at android.content.ContentResolver.openAssetFileDescriptor (ContentResolver.java:1313)
  at android.content.ContentResolver.openInputStream (ContentResolver.java:1033)
  at fr.free.nrw.commons.filepicker.PickedFiles.pickedExistingPicture (PickedFiles.java:112)
  at fr.free.nrw.commons.filepicker.FilePicker.getFilesFromGalleryPictures (FilePicker.java:433)
  at fr.free.nrw.commons.filepicker.FilePicker.handleExternalImagesPicked (FilePicker.java:344)
  at fr.free.nrw.commons.contributions.ContributionController.handleExternalImagesPicked (ContributionController.java:119)
  at fr.free.nrw.commons.upload.UploadActivity.receiveExternalSharedItems (UploadActivity.java:379)
  at fr.free.nrw.commons.upload.UploadActivity.receiveSharedItems (UploadActivity.java:307)
  at fr.free.nrw.commons.upload.UploadActivity.lambda$uFmJNhak7opat5jgMvaezcNPkNM (Unknown Source)
  at fr.free.nrw.commons.upload.-$$Lambda$UploadActivity$uFmJNhak7opat5jgMvaezcNPkNM.run (Unknown Source:2)
  at fr.free.nrw.commons.utils.PermissionUtils$1.onPermissionGranted (PermissionUtils.java:114)
  at com.karumi.dexter.MultiplePermissionsListenerToPermissionListenerAdapter.onPermissionsChecked (Unknown Source:35)
  at com.karumi.dexter.DexterInstance$1.run (Unknown Source:43)
  at com.karumi.dexter.MainThread.execute (Unknown Source:6)
  at com.karumi.dexter.DexterInstance.checkMultiplePermissions (Unknown Source:56)
  at com.karumi.dexter.DexterInstance.checkPermissions (Unknown Source)
  at com.karumi.dexter.Dexter.check (Unknown Source:10)
  at fr.free.nrw.commons.utils.PermissionUtils.checkPermissionsAndPerformAction (PermissionUtils.java:144)
  at fr.free.nrw.commons.utils.PermissionUtils.checkPermissionsAndPerformAction (PermissionUtils.java:82)
  at fr.free.nrw.commons.upload.UploadActivity.onCreate (UploadActivity.java:129)
  at android.app.Activity.performCreate (Activity.java:7458)
  at android.app.Activity.performCreate (Activity.java:7448)
  at android.app.Instrumentation.callActivityOnCreate (Instrumentation.java:1286)
  at android.app.ActivityThread.performLaunchActivity (ActivityThread.java:3409)

Device and Android version:

Huawei Mate 10 Pro (HWBLA), 5888MB RAM, Android 9

Commons app version:

current Prod, app version 561

[macgills]

https://stackoverflow.com/a/46722623 so this user experienced this problem

I finally managed to fix this. Apparently it is because the permission for the given uri is only valid as long as the receiving activity is active.

Maybe the permission was lost by activity recreation? Doesn't sound right to me but I don't trust Dexter or any of these Permissions libraries too much as they generally add an invisible activity/fragment to do the permission request. I am suspicious of this Runnable.
It looks like Dexter has an option of Running on same thread link so that might help us?

Now that SO answer is from '17 and android's war on storage is only getting worse. I am not positive on what would be the best action. Maybe SAF, maybe MediaStore? The storage landscape is shakier than it maybe ever has been right now.

[macgills]

Anyway long winded comment aside I am fine with catching this exception but perhaps another ticket should be opened to explore this in the future?

[ashishkumar468]

Isn't the URI permission given to the application as a whole and not a single activity?. I have never been able to reproduce this personally but I have seen this happening even before we started using dexter.

[macgills]

Docs says

receiving activity

UriPermission!=Manifest.Permission