[firebase-ml-modeldownloader] downloadUri from server response is not validated against expected Google/Firebase domains before being passed to DownloadManager

オープン
  • 何か問題がありますか？
#8,011 コメント 1 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@rlazo がすでに取り組んでいます。

2026年4月13日 から。

評価

この issue はまだ評価されていません。

説明

api: mlkit

Summary

The firebase-ml-modeldownloader SDK fetches model metadata from firebaseml.googleapis.com and receives a downloadUri field in the JSON response. This URI is passed directly and without any validation to DownloadManager.enqueue(), which then downloads the file and stores it in the app's private storage as a trusted ML model.

The SDK is designed to exclusively download models hosted on Firebase/Google Cloud Storage — there is no public API for developers to supply a custom download URL. Despite this, the code places zero constraints on the downloadUri value at the point of consumption, creating an unnecessary and avoidable risk surface.

Affected Files

File Line Action
firebase-ml-modeldownloader/src/main/java/com/google/firebase/ml/modeldownloader/internal/CustomModelDownloadService.java ~370 downloadUrl = reader.nextString() — raw URL read from JSON, no validation
firebase-ml-modeldownloader/src/main/java/com/google/firebase/ml/modeldownloader/internal/ModelFileDownloadService.java ~283 downloadManager.enqueue(new Request(Uri.parse(customModel.getDownloadUrl()))) — unvalidated URL passed to DownloadManager

Code Flow

Firebase ML backend response (JSON):
  { "downloadUri": "<url>", "expireTime": "...", "sizeBytes": 1234 }
    → CustomModelDownloadService.readCustomModelResponse()        [line ~370]
      → downloadUrl = reader.nextString()   ← NO host/scheme check
        → CustomModel object stores the raw URL
          → ModelFileDownloadService.scheduleModelDownload()      [line ~283]
            → new Request(Uri.parse(customModel.getDownloadUrl()))
              → downloadManager.enqueue(request)
                → Android DownloadManager fetches the URL
                  → File written to app private storage as a trusted ML model

Why This Is a Problem

The downloadUri in the server response is always expected to be a Google Cloud Storage URL (e.g., https://firebasestorage.googleapis.com/... or https://storage.googleapis.com/...). The SDK was never designed to accept model files from third-party hosts.

However, the code does not enforce this expectation. Any URL that reaches DownloadManager.enqueue() will be fetched and stored unconditionally.

Scenarios where a non-Google URL could reach this code path:

  • Corporate/enterprise network with MDM-managed CA: extremely common in enterprise Android deployments where a trusted proxy CA is pushed via MDM, enabling transparent TLS inspection of all HTTPS traffic
  • Compromised or misconfigured Firebase ML backend (supply-chain scenario)
  • Future regression — a developer refactoring the URL construction logic could inadvertently introduce an externally-influenced URL without realising there is no downstream validation

Note: This is not claimed as a trivially exploitable remote attack. It is a defense-in-depth gap: the SDK makes a strong implicit assumption about the URL it receives but never validates it, when doing so would be trivial and non-breaking.

Impact

If a non-Google URL were to reach DownloadManager.enqueue() through any of the above paths:

  1. Arbitrary file download — any binary can be written to the app's private NoBackupFilesDir under com.google.firebase.ml.custom.models/, labeled as a trusted model
  2. ML integrity violation — even without code execution, a substituted model (e.g., a fraud-detection model that always outputs "not fraud") silently corrupts the app's ML-dependent behaviour
  3. Potential memory corruption — the downloaded file is subsequently loaded by TensorFlow Lite. TFLite has a documented history of memory corruption vulnerabilities when parsing malformed model files (e.g., CVE-2022-23553), making this a plausible escalation path on devices with vulnerable TFLite versions

Proposed Fix

1. Validate downloadUri against an allowlist of expected Firebase/Google domains
// In CustomModelDownloadService.java — where downloadUrl is read from JSON
} else if (name.equals("downloadUri")) {
    String rawUrl = reader.nextString();
    Uri parsed = Uri.parse(rawUrl);
    String host = parsed.getHost();
    if (!"https".equals(parsed.getScheme()) ||
        host == null ||
        (!host.endsWith(".googleapis.com") &&
         !host.endsWith(".firebasestorage.app") &&
         !host.endsWith(".storage.googleapis.com"))) {
        throw new IOException("downloadUri host is not an allowlisted Firebase/Google domain: " + host);
    }
    downloadUrl = rawUrl;
}

This fix has zero impact on legitimate usage — all real Firebase ML download URLs already come from .googleapis.com or .firebasestorage.app. No developer-facing API change is required.

2. (Recommended) Verify model file integrity before loading

The server response already includes a modelHash / ETag value. Verifying the SHA-256 of the downloaded file against this hash before passing it to TFLite would eliminate the file-substitution risk entirely, even in the absence of URL validation.

References

主要言語
Java
スター
2.6k
フォーク
733
平均マージ
2日 15時間
マージ済み PR（30日）
72

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

firebase/firebase-android-sdk のほかの issue

firebase/firebase-android-sdk の issue をすべて見る

似ている issue

Java の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。