Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

am 8c65ab81: Merge "Updated "Designing for Security" documentation" into ics-mr1

Browse Source 
* commit '8c65ab81e84f36c311d2ae6831819a5caa404548':
  Updated "Designing for Security" documentation
This commit is contained in:
Dirk Dougherty
2011-12-16 10:58:42 -08:00
committed by Android Git Automerger
parent fa0f39c545 8c65ab81e8
commit 41a7998df7
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/html/guide/practices/security.jd
View File

@@ -552,7 +552,7 @@ the minimum functionality required by your application.</p>
<p>If your application does not directly use JavaScript within a <code><a <p>If your application does not directly use JavaScript within a <code><a
href="{@docRoot}reference/android/webkit/WebView.html">WebView</a></code>, do href="{@docRoot}reference/android/webkit/WebView.html">WebView</a></code>, do
not call not call
<a href="{@docRoot}reference/android/webkit/WebSettings.html#setJavaScriptEnabled(boolean) <a href="{@docRoot}reference/android/webkit/WebSettings.html#setJavaScriptEnabled(boolean)">
<code>setJavaScriptEnabled()</code></a>. We have seen this method invoked <code>setJavaScriptEnabled()</code></a>. We have seen this method invoked
in sample code that might be repurposed in production application -- so in sample code that might be repurposed in production application -- so
remove it if necessary. By default, <code><a remove it if necessary. By default, <code><a
@@ -686,6 +686,15 @@ with personal information. This topic is discussed in more detail in the <a
href="http://android-developers.blogspot.com/2011/03/identifying-app-installatio href="http://android-developers.blogspot.com/2011/03/identifying-app-installatio
ns.html">Android Developer Blog</a>.</p> ns.html">Android Developer Blog</a>.</p>
<p>Application developers should be careful writing to on-device logs.
In Android, logs are a shared resource, and are available
to an application with the
<a href="{@docRoot}reference/android/Manifest.permission.html#READ_LOGS">
<code>READ_LOGS</code></a> permission. Even though the phone log data
is temporary and erased on reboot, inappropriate logging of user information
could inadvertently leak user data to other applications.</p>
<h3>Handling Credentials</h3> <h3>Handling Credentials</h3>
<p>In general, we recommend minimizing the frequency of asking for user <p>In general, we recommend minimizing the frequency of asking for user