# Path resolved before safety check

Resolved paths read or returned before containment, lock, or ownership checks run

_Area: Web access control and IDOR. Seen in 2 disclosed reports; latest 2026-05-28. Updated 2026-11-01._

## How it works
A path (include directive, content:// URI, share source) becomes a concrete file or directory reference before the check that should constrain it runs. Three shapes appear in the evidence: a write path skips the validator so a bad path survives to be resolved later [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c3px-h233-h6fq.md); a cross-user namespace is not gated by profile lock state [E2](https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-sve-2020-18025-unauthorised-access-to-samsung-secure-folder-files.md); or resolution picks the wrong target, the owner's root instead of the shared item [E3](https://bugbountylibrary.com/r/h1%3A258084.md). The broken assumption is that every path reaching a resolver was already validated, or that the resolver targets the item the user selected.

## Where it shows up
- Sibling write paths (create vs update) where only one calls the validator [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c3px-h233-h6fq.md)
- A read endpoint that returns file contents before a subdirectory containment check [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c3px-h233-h6fq.md)
- Multi-user storage (work profiles, Secure Folder) reachable via cross-user content:// URIs without lock enforcement [E2](https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-sve-2020-18025-unauthorised-access-to-samsung-secure-folder-files.md)
- Copy/move on share mountpoints that resolve to the owner's underlying path [E3](https://bugbountylibrary.com/r/h1%3A258084.md)
- Alternate access paths (WebDAV, sync clients) that bypass the UI's checks [E3](https://bugbountylibrary.com/r/h1%3A258084.md)

## How to review
List every path that produces or consumes a resolved path. Confirm the containment/lock/ownership check runs on the same value the resolver uses, before resolution, on all paths. Compare sibling handlers for a missing validator call [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c3px-h233-h6fq.md). For shares, verify copy/move resolves to the shared item, not the owner's root [E3](https://bugbountylibrary.com/r/h1%3A258084.md). For multi-user storage, verify lock state is enforced at the content provider, not just the UI [E2](https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-sve-2020-18025-unauthorised-access-to-samsung-secure-folder-files.md). Invariant: no resolved path is read or returned unless it passed the check for that exact path.

## Variants seen
- Missing validator on create path; read returns include contents pre-check [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c3px-h233-h6fq.md)
- Content provider resolves cross-user URIs without enforcing profile lock [E2](https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-sve-2020-18025-unauthorised-access-to-samsung-secure-folder-files.md)
- WebDAV copy of a share resolves to owner's home directory [E3](https://bugbountylibrary.com/r/h1%3A258084.md)

## Impact and severity
Arbitrary host file read including the app database [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c3px-h233-h6fq.md); exposure of locked Secure Folder files to JavaScript [E2](https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-sve-2020-18025-unauthorised-access-to-samsung-secure-folder-files.md); full home directory disclosure to a share recipient [E3](https://bugbountylibrary.com/r/h1%3A258084.md). Severity rises when the leaked path is a credential store or when enumeration is scriptable.

## Why fixes fail
E1 shows the update path validated includes while create did not; fixing one path leaves the other. Audit all entry points, not just the reported one. This is single-evidence; the other reports do not show regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-c3px-h233-h6fq.md
- E2: https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-sve-2020-18025-unauthorised-access-to-samsung-secure-folder-files.md
- E3: https://bugbountylibrary.com/r/h1%3A258084.md