What
SendFile and the message-send path now share a single permission routine when isolation between peer machines is turned on. It re-asks for permission, and refuses the send if the answer comes back altered.
Details
- Refusals name their reason:
recipient_changedwhen the permission handler points the send at a different recipient,bad_shapewhen it returns something the tool cannot accept, andnon_text_messagewhen it rewrites the message into a non-text form. - Only runs when peer-machine isolation is on and the permission phase has not already happened for that send.
Evidence
The permission handler changed the recipient (from
Strings lifted out of the shipped bundle, so the claim above can be checked against them.