diff options
| author | 2023-06-20 21:24:36 +0000 | |
|---|---|---|
| committer | 2023-06-28 21:00:52 +0000 | |
| commit | ad7af76515094a9e8141ed74ef38abef538c563a (patch) | |
| tree | 8c6787defe84076dd6e18d20a8944309a1cd702c /libs/androidfw/StringPool.cpp | |
| parent | 98c176bcf200f046775b88f6c24fe997a1c0a7d0 (diff) | |
[DO NOT MERGE] Verify URI Permissions in Autofill RemoteViews
Check permissions of URI inside of FillResponse's RemoteViews. If the
current user does not have the required permissions to view the URI, the
RemoteView is dropped from displaying.
This fixes a security spill in which a user can view content of another
user through a malicious Autofill provider.
Bug: 283137865
Fixes: b/283264674 b/281666022 b/281665050 b/281848557 b/281533566
b/281534749 b/283101289
Test: Verified by POC app attached in bugs
Test: atest CtsAutoFillServiceTestCases (added new tests)
Change-Id: I6f4d2a35e89bbed7bd9e07bf5cd3e2d68b20af9a
Diffstat (limited to 'libs/androidfw/StringPool.cpp')
0 files changed, 0 insertions, 0 deletions