Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "docs: Updated link, wording associated with data-sharing IPC." into mnc-mr-docs am: c501688

Browse Source 
am: 7bce49c

* commit '7bce49c5f11ada85c296c6ba6666c15d3306f564':
  docs: Updated link, wording associated with data-sharing IPC.

Change-Id: Ib9e6732c29f9bda5e786e7cdbc1964f86e97cf51
This commit is contained in:
Kevin Hufnagle
2016-04-26 07:56:53 +00:00
committed by android-build-merger
parent ed0adf4bca 7bce49c5f1
commit 31d841c937
1 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
docs/html/training/articles/security-tips.jd
View File

@@ -150,7 +150,7 @@ limited by the <code><a
href="{@docRoot}guide/topics/manifest/grant-uri-permission-element.html"> href="{@docRoot}guide/topics/manifest/grant-uri-permission-element.html">
&lt;grant-uri-permission element&gt;</a></code>.</p> &lt;grant-uri-permission element&gt;</a></code>.</p>
<p>When accessing a content provider, use parameterized query methods such as <p>When accessing a content provider, use parameterized query methods such as
{@link android.content.ContentProvider#query(Uri,String[],String,String[],String) query()}, {@link android.content.ContentProvider#query(Uri,String[],String,String[],String) query()},
{@link android.content.ContentProvider#update(Uri,ContentValues,String,String[]) update()}, and {@link android.content.ContentProvider#update(Uri,ContentValues,String,String[]) update()}, and
{@link android.content.ContentProvider#delete(Uri,String,String[]) delete()} to avoid {@link android.content.ContentProvider#delete(Uri,String,String[]) delete()} to avoid
@@ -207,13 +207,13 @@ href="{@docRoot}guide/topics/manifest/permission-element.html#plevel">signature
protection level</a> on permissions for IPC communication between applications protection level</a> on permissions for IPC communication between applications
provided by a single developer.</p> provided by a single developer.</p>
<p>Do not leak permission-protected data. This occurs when your app exposes data <p>Do not leak permission-protected data. This occurs when your app exposes
over IPC that is only available because it has a specific permission, but does data over IPC that is available only because your app has permission to access
not require that permission of any clients of it’s IPC interface. More that data. The clients of your app's IPC interface may not have that same
details on the potential impacts, and frequency of this type of problem is data-access permission. More details on the frequency and potential effects
provided in this research paper published at USENIX: <a of this issue appear in <a class="external-link"
href="http://www.cs.berkeley.edu/~afelt/felt_usenixsec2011.pdf">http://www.cs.be href="https://www.usenix.org/legacy/event/sec11/tech/full_papers/Felt.pdf"> this
rkeley.edu/~afelt/felt_usenixsec2011.pdf</a></p> research paper</a>, published at USENIX.
@@ -431,14 +431,14 @@ not execute JavaScript so cross-site-scripting is not possible.</p>
<p>Use {@link android.webkit.WebView#addJavascriptInterface <p>Use {@link android.webkit.WebView#addJavascriptInterface
addJavaScriptInterface()} with addJavaScriptInterface()} with
particular care because it allows JavaScript to invoke operations that are particular care because it allows JavaScript to invoke operations that are
normally reserved for Android applications. If you use it, expose normally reserved for Android applications. If you use it, expose
{@link android.webkit.WebView#addJavascriptInterface addJavaScriptInterface()} only to {@link android.webkit.WebView#addJavascriptInterface addJavaScriptInterface()} only to
web pages from which all input is trustworthy. If untrusted input is allowed, web pages from which all input is trustworthy. If untrusted input is allowed,
untrusted JavaScript may be able to invoke Android methods within your app. In general, we untrusted JavaScript may be able to invoke Android methods within your app. In general, we
recommend exposing {@link android.webkit.WebView#addJavascriptInterface recommend exposing {@link android.webkit.WebView#addJavascriptInterface
addJavaScriptInterface()} only to JavaScript that is contained within your application APK.</p> addJavaScriptInterface()} only to JavaScript that is contained within your application APK.</p>
<p>If your application accesses sensitive data with a <p>If your application accesses sensitive data with a
{@link android.webkit.WebView}, you may want to use the {@link android.webkit.WebView}, you may want to use the
{@link android.webkit.WebView#clearCache clearCache()} method to delete any files stored {@link android.webkit.WebView#clearCache clearCache()} method to delete any files stored
locally. Server-side locally. Server-side