diff options
| author | Jeff Sharkey <jsharkey@android.com> | 2016-11-18 14:23:23 -0700 |
|---|---|---|
| committer | Jeff Sharkey <jsharkey@android.com> | 2016-11-18 15:37:08 -0700 |
| commit | 9b858626204913b29dc677ee265e54cd14717484 (patch) | |
| tree | 0e5609745f8388c415a376dade6713518db7b984 /core/java/android | |
| parent | b1f1209d9a3321d8bc44529406a3e210524d5e3a (diff) | |
DO NOT MERGE. Check provider access for content changes.
For an app to either send or receive content change notifications,
require that they have some level of access to the underlying
provider.
Without these checks, a malicious app could sniff sensitive user data
from the notifications of otherwise private providers.
Test: builds, boots, PoC app now fails
Bug: 32555637
Change-Id: If2dcd45cb0a9f1fb3b93e39fc7b8ae9c34c2fdef
Diffstat (limited to 'core/java/android')
| -rw-r--r-- | core/java/android/app/ActivityManagerInternal.java | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/core/java/android/app/ActivityManagerInternal.java b/core/java/android/app/ActivityManagerInternal.java index 2a17fa6a8a26..34e59106d5e2 100644 --- a/core/java/android/app/ActivityManagerInternal.java +++ b/core/java/android/app/ActivityManagerInternal.java @@ -22,6 +22,11 @@ package android.app; * @hide Only for use within the system server. */ public abstract class ActivityManagerInternal { + /** + * Verify that calling app has access to the given provider. + */ + public abstract String checkContentProviderAccess(String authority, int userId); + // Called by the power manager. public abstract void goingToSleep(); public abstract void wakingUp(); |