Shortcuts can access file:/// urls with url input block and pass it on to different blocks

Originator:AmpleSpencer
Number:rdar://46642272 Date Originated:12/11/18
Status:Open Resolved:No
Product:iOS Product Version:12-12.1.1 (more affective on versions with the icloud drive app)
Classification:SiriKit/Security Reproducible:100%
 
Area:
SiriKit

Summary:
Shortcuts can save and somewhat manipulate file:/// urls

Steps to Reproduce:
Shortcuts app

url block [file:///System/Library/CoreServices]
           |
           |
save block/other block
Expected Results:
error: shortcuts is not able to access this url because it is a local file url

Actual Results:
Copies CoreServices/other folder it can access and puts it in files app

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!