The path-permission element offers prefix or regex style matching of
paths, but most providers internally use UriMatcher to decide what
to do with an incoming Uri.
This causes trouble because UriMatcher uses Uri.getPathSegments(),
which quietly ignores "empty" paths. Consider this example:
<path-permission android:pathPrefix="/private" ... />
uriMatcher.addURI("com.example", "/private", CODE_PRIVATE);
content://com.example//private
The Uri above will pass the security check, since it's not
technically a prefix match. But the UriMatcher will then match it
as CODE_PRIVATE, since it ignores the "//" zero-length path.
Since we can't safely change the behavior of either path-permission
or UriMatcher, we're left with recovering these shady paths by
trimming away zero-length paths.
Bug: 112555574
Test: cts-tradefed run cts -m CtsAppSecurityHostTestCases -t android.appsecurity.cts.AppSecurityTests
Change-Id: Ibadbfa4fc904ec54780c8102958735b03293fb9a
This reverts commit 8da6786608.
Reason for revert: Not a security fix and the security fix needs this cl is reverted.
Bug: 114365189
Change-Id: I1826a5b6889f21fbbe16311a3da66c93e26383f3
* changes:
[automerger] Verify number of Map entries written to Parcel am: 057a01d1f3 am: d6947f1cbf
[automerger] Verify number of Map entries written to Parcel am: 057a01d1f3
Verify number of Map entries written to Parcel
* changes:
[automerger skipped] Hide overlay windows when requesting media projection permission. skipped: 5c3f5a02bd skipped: 3eb97a9bd9
[automerger skipped] Hide overlay windows when requesting media projection permission. skipped: 5c3f5a02bd
Hide overlay windows when requesting media projection permission.
* changes:
[automerger skipped] Hide overlay windows when requesting media projection permission. skipped: 5c3f5a02bd
Hide overlay windows when requesting media projection permission.
* changes:
[automerger] RESTRICT AUTOMERGE: Hide overlay windows when requesting media projection permission. am: 295af36009
RESTRICT AUTOMERGE: Hide overlay windows when requesting media projection permission.
1: Cherry-pick ag/4067454 - Setting PRIVATE_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS
updateNonSystemOverlayWindowsVisibilityIfNeeded on relayoutWindow
2: Cherry-pick ag/3650369 - If PRIVATE_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS changed on
relayoutWindow() then updateNonSystemOverlayWindowsVisibilityIfNeeded
3: Add permissions to SystemUI to allow it to hide non-system overlays
Bug: 34170870
Test: manual (see bug for poc)
Change-Id: I57cb0f390d9a78e721c5ddce49a377d385002753
1: Cherry-pick ag/4067454 - Setting PRIVATE_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS
updateNonSystemOverlayWindowsVisibilityIfNeeded on relayoutWindow
2: Cherry-pick ag/3650369 - If PRIVATE_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS changed on
relayoutWindow() then updateNonSystemOverlayWindowsVisibilityIfNeeded
3: Add permissions to SystemUI to allow it to hide non-system overlays
Bug: 34170870
Test: manual (see bug for poc)
Change-Id: I57cb0f390d9a78e721c5ddce49a377d385002753
Make sure the number of entries written by Parcel#writeMapInternal
matches the size written. If a mismatch were allowed, an exploitable
scenario could occur where the data read from the Parcel would not
match the data written.
Fixes: 112859604
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest
Change-Id: I325d08a8b66b6e80fe76501359c41b6656848607
Merged-In: I325d08a8b66b6e80fe76501359c41b6656848607
* changes:
[automerger] Fix crash during cursor moving on BiDi text am: 95218ce7ea am: b7a2d47ec2 skipped: 723f13d01f am: 04c7154fd9
[automerger] Fix crash during cursor moving on BiDi text am: 95218ce7ea am: b7a2d47ec2 skipped: 723f13d01f
[automerger] Fix crash during cursor moving on BiDi text am: 95218ce7ea am: b7a2d47ec2
[automerger] Fix crash during cursor moving on BiDi text am: 95218ce7ea
Fix crash during cursor moving on BiDi text
The crash was introduced by Ib66ef392c19c937718e7101f6d48fac3abe51ad0
The root cause of the crashing is requesting out-of-line access for the
horizontal width. This invalid access is silently ignored by
TextLine#measure() method but new implementation end up with out of
bounds access.
To makes behavior as old implementation, calling getHorizontal instead
of accessing measured result array.
Bug: 78464361, 111580019
Test: Manually done
Change-Id: I5c5778718f6b397adbb1e4f2cf95e9f635f6e5c8
(cherry picked from commit 960647d582)
Merged-In: I5c5778718f6b397adbb1e4f2cf95e9f635f6e5c8
The crash was introduced by Ib66ef392c19c937718e7101f6d48fac3abe51ad0
The root cause of the crashing is requesting out-of-line access for the
horizontal width. This invalid access is silently ignored by
TextLine#measure() method but new implementation end up with out of
bounds access.
To makes behavior as old implementation, calling getHorizontal instead
of accessing measured result array.
Bug: 111580019
Test: Manually done
Change-Id: I5c5778718f6b397adbb1e4f2cf95e9f635f6e5c8
Merged-In: Ib66ef392c19c937718e7101f6d48fac3abe51ad0
* changes:
[automerger] RESTRICT AUTOMERGE: Revoke permissions defined in a to-be removed package. am: fa69d725eb am: 7d252f5ed7
[automerger] RESTRICT AUTOMERGE: Revoke permissions defined in a to-be removed package. am: fa69d725eb
RESTRICT AUTOMERGE: Revoke permissions defined in a to-be removed package.
* changes:
[automerger] RESTRICT AUTOMERGE: Revoke permissions defined in a to-be removed package. am: fa69d725eb
RESTRICT AUTOMERGE: Revoke permissions defined in a to-be removed package.
