remember when google blocked access to /sdcard/Android/data for "security" reasons?

lmao
its a trillion dollar company ffs
@vox wait what's happening here?
@Mae@is.badat.dev adding zero width space to the directory name lol

and it suddenly becomes readable
@vox no I get that but like why are the files there? A ZWS should mean it's a different directory
@Mae@is.badat.dev /sdcard is a FUSE filesystem (with fat32-like path normalization), sth's going wrong there i assume
@vox has this been reported to google yet lol
@Mae @vox please NEVER do that (i mean maybe you should but like. ugggghh i just want to access app data folders without re-rooting calyxos every update)
@pup @vox I'm not gonna but the fact that this has been posted publicly means it might get reported by someone else
@Mae @vox yeah. i mean it's probably for the best that it does but still GRR BARK SNARL LET ME READ APPDATA OVER ADB
@pup @vox security was the worst invention
@vox can’t repro, what android version is that?
@easrng@pleroma.envs.net android 14 (samsung oneui) with october security updates
@vox in termux or only in adb?
@easrng@pleroma.envs.net
both termux and any file explorer, havent tried adb (reportedly only works on some android builds)
@vox (I’m on grapheneos btw)
@vox okay but can you write to it
@vox actually hilarious, I wonder what's causing some builds to not be affected but still fun
@vox holy shit it works?? (android 14 miui btw)
@vox can't repro on grapheneos

cannot tell if that's a good thing (no vuln) or a bad thing (i fucking want access to my files please)

@vox Android 15 on a Pixel (not rooted)

I'm either doing something wrong or they broke it further

@VasilisTheChu
that's the adb shell.
the one in the screenshot is running with normal app context (in termux).
you can also add zwsp to the path in any file explorer app and it would work as well
@vox Android has not yet won its war against the filesystem.
@vox well what do you know! Can't wait for the write-up on this one lol

#CyberSec #Security #Hacking
@vox oh that's fun, you can recurse into subdirectories and access files too
@hazelnoot
you can also write stuff :3 (basically full access)
@vox @hazelnoot if it's an actual SD card, anyone could just take it out and put it into a normal device and bypass the silly restriction on accessing your own data on your own storage device.
@zymurgic @vox it's not actually an SD card - this is an encrypted partition on the internal storage
@vox
"com.companyname.andriodapp1" πŸ™€
@vox
Apparently "Seeker" by "ShinjiIndustrial". Interesting.
GitHub - jackBonadies/SeekerAndroid: Android client for the Soulseek peer-to-peer network

Android client for the Soulseek peer-to-peer network - jackBonadies/SeekerAndroid

GitHub
@vox
I just found the typo somewhat peculiar.
@vox wait, how does this work? I would have assumed that the permission denied is generated by SELinux, which doesn't care about the string representation of a path
@vox Whoops, nice, also works on CalyxOS 6.1.0 (Android 15)
@calyxos #calyxos

@vox hmm

Not working via Termux on a Samsung phone, with security update from a month or two ago