diff options
| author | 2022-09-08 11:16:29 +0800 | |
|---|---|---|
| committer | 2022-09-12 11:35:38 +0800 | |
| commit | 3a8bfc972e6327045b255845800db9947037a963 (patch) | |
| tree | a33ba3384b6b11cba16556d4ad09b78867afa883 /libs/androidfw/StringPool.cpp | |
| parent | e2a41d3525a7643fbd978b8d9ac5d06cffdc326c (diff) | |
Honor app visibility when get MIME type from ContentProvider
APIs getProviderMimeType and getProviderMimeTypeAsync from Activity-
ManagerService don't check whether the ContentProvider holder of the
given URI is visible to the callers.This leaves the possibility that
malicious code could do a side channel attack. Apply the visibility
check to mitigate this.
Bug: 185126503
Bug: 185126713
Test: atest CtsContentTestCases
Test: atest CtsProviderTestCases
Test: manually using the PoC in the buganizer to ensure the symptom
no longer exists.
Test: manually testing with the repro steps in buganizer to ensure
this CL doesn't break app cloning.
Change-Id: I07c906fb9abfefd15660e506de1c1a398b3b0819
Diffstat (limited to 'libs/androidfw/StringPool.cpp')
0 files changed, 0 insertions, 0 deletions