Malicious callers can leak side-channel information by using
subqueries in any untrusted inputs where SQLite allows "expr" values.
This change offers setStrictGrammar() to prevent this by outright
blocking subqueries in WHERE and HAVING clauses, and by requiring
that GROUP BY and ORDER BY clauses be composed only of valid columns.
This change also offers setStrictColumns() to require that all
untrusted column names are valid, such as those in ContentValues.
Relaxes to always allow aggregation operators on returned columns,
since untrusted callers can always calculate these manually.
Bug: 135270103, 135269143
Test: atest android.database.sqlite.cts.SQLiteQueryBuilderTest
Test: atest FrameworksCoreTests:android.database.sqlite.SQLiteTokenizerTest
Change-Id: I0dacb53170ce573a2fe103cbff455782bfdb5d41
Instead of storing each Locale within a Configuration object's locale
list by its language, country, variant, and script to proto, store the
entire locale list by its language tags representation which accurately
describes each locale.
Bug: 140197723
Test: atest ConfigurationTest
Test: atest UsageStatsDatabaseTest
Test: manually with bad data
Merged-In: I53946ed4e31de0ffe9c84875c391a7dec6f5375a
Change-Id: Idaae690f79a5c680ad0059a52be62160d9dfb5e7
If a user has an AlarmClock going off within the next hour, the device
won't go into deep Doze. When in Battery Saver, the system tries to
enter deep Doze faster, scheduling an alarm one minute after the screen
turns off to enter deep Doze. This conflict results in the system
scheduling a wakeup alarm every minute until the AlarmClock alarm.
Switching to a non-wakeup alarm prevents the system from waking up every
minute if the device is in Battery Saver mode and there's an AlarmClock
scheduled within the next hour.
Bug: 135975445
Test: atest com.android.server.DeviceIdleControllerTest
Change-Id: Ia60ec769979dc9a792dc73f2a6a646397af7adcb
Merged-In: I98bf4131b7b4a1006e37aa42bcbc7dda7e137d1d
Strict SQLiteQueryBuilder needs to be stricter.
Malicious callers can leak side-channel information by using
subqueries in any untrusted inputs where SQLite allows "expr" values.
This change offers setStrictGrammar() to prevent this by outright
blocking subqueries in WHERE and HAVING clauses, and by requiring
that GROUP BY and ORDER BY clauses be composed only of valid columns.
This change also offers setStrictColumns() to require that all
untrusted column names are valid, such as those in ContentValues.
Relaxes to always allow aggregation operators on returned columns,
since untrusted callers can always calculate these manually.
Bug: 135270103, 135269143
Test: cts-tradefed run cts -m CtsDatabaseTestCases -t android.database.sqlite.cts.SQLiteQueryBuilderTest
Change-Id: I6290afd19c966a8bdca71c377c88210d921a9f25
This change eliminates the strong reference from
RequestFinishCallback to Activity.
Bug: 139782368
Test: Open then finish an activity within an ongoing app process
Observe the Activity instance is no longer strongly reachable
in the app process after onDestroy() completes.
Change-Id: I13e9707e96721a2d491629147337aaedc3473651
Enable stricter SQLiteQueryBuilder options.
Malicious callers can leak side-channel information by using
subqueries in any untrusted inputs where SQLite allows "expr" values.
This change starts using setStrictColumns() and setStrictGrammar()
on SQLiteQueryBuilder to block this class of attacks. This means we
now need to define the projection mapping of valid columns, which
consists of both the columns defined in the public API and columns
read internally by DownloadInfo.Reader.
We're okay growing sAppReadableColumnsSet like this, since we're
relying on our trusted WHERE clause to filter away any rows that
don't belong to the calling UID.
Remove the legacy Lexer code, since we're now internally relying on
the robust and well-tested SQLiteTokenizer logic.
Bug: 135270103
Bug: 135269143
Test: atest DownloadProviderTests
Test: atest CtsAppTestCases:android.app.cts.DownloadManagerTest
Change-Id: Iec1e8ce18dc4a9564318e0473d9d3863c8c2988a
When an Acitivty enter PictureInPicture mode, the pip input consumer
would be created and show the PipMenuActivity at first entry
(MENU_STATE_CLOSE) or show full menu (MENU_STATE_FULL) if user clicks
the pip window.
So in order to control the pip wndow dragging and menu, the pip input
consumer would be destoryed when menu window has shown, and it would be
created when the pip window starts to drag or the menu has hidden.
And the menu window should also has the flag FLAG_SLIPPERY to make sure
touch can through to the pip input consumer, but it could not guarantee
which window can receive the touch.
This patch would make sure all touch events except ACTION_OUTSIDE can
go through pip input consumer because it's above the pip window and it
can integrate all behaviors like window dragging or show menu in
PipTouchHandler without doing same thing and adding FLAG_SLIPPERY in
PipMenuActivity.
Test: atest PinnedStackTests
Test: atest SystemUITests
Bug: 139805619
Change-Id: I35f9eba867561168384d0a0d6c0608a6dbdf6a09
(cherry picked from commit d52d119330)
Currently bugreports are missing OMS settings for non-system users. This
change dumps overlay information for all users when the --user flag is
not provided and it fixes the --user flag not parsing the specified id
correctly.
Bug: 137796495
Bug: 136549878
bug: 140734485
Test: manual
Change-Id: I0d545253179b3545307b88b3151d11fd9e6cbd5b
(cherry picked from commit b7ef06ac37)
Creating a SystemConfig from a non-system process is taking 500+ ms.
This CL instead exposes the needed split permissions from system_server
to optimize performance.
Tested locally and creating PermissionManager / retrieving SystemConfig
is now less than 1 ms.
Bug: 139828734
Bug: 139485700
Fixes: 139828734
Test: Added systrace / logs to PermissionController app and traced
runtime of onGrantDefaultRoles().
Merged-In: I111403e8dae3bc2b0acafc32e61aa5cd890fea29
Change-Id: I111403e8dae3bc2b0acafc32e61aa5cd890fea29
(cherry picked from commit f69c71e25889d8a9d66da05ee0f386d7fb626c6c)
one
When there's no users' choice to tell us whether to share their
phonebook information to the Bluetooth device, set the phonebook access
permission to ACCESS_REJECTED.
Bug: 138529441
Test: Manual test
Change-Id: Iefabeb731b941f09fe1272ac7b7cd2feba75c8df
Merged-In: Iefabeb731b941f09fe1272ac7b7cd2feba75c8df
Instead of storing each Locale within a Configuration object's locale
list by its language, country, variant, and script to proto, store the
entire locale list by its language tags representation which accurately
describes each locale.
Bug: 140197723
Test: atest ConfigurationTest
Test: atest UsageStatsDatabaseTest
Test: manually with bad data
Change-Id: Id0e63ae4a7be578d1e93838b371320f86a787e0e
one
When there's no users' choice to tell us whether to share their
phonebook information to the Bluetooth device, set the phonebook access
permission to ACCESS_REJECTED.
Bug: 138529441
Test: Manual test
Change-Id: Iefabeb731b941f09fe1272ac7b7cd2feba75c8df
Merged-In: Iefabeb731b941f09fe1272ac7b7cd2feba75c8df
When the configurations are being read from the proto file, if a
duplicate locale is found in the list, an exception is thrown from
LocaleList which causes the UsageStatsService to crash. Instead, we'll
now log a WTF if duplicate locales are found when parsing the
configuration proto and not add the duplicate locale to the list.
Bug: 140197723
Test: atest UsageStatsDatabaseTest
Change-Id: Ie178b3cfdd45e6771a7c0e4bb42e47f79b5c30cc
(cherry picked from commit 5d9031dbee)
one
When there's no users' choice to tell us whether to share their
phonebook information to the Bluetooth device, set the phonebook access
permission to ACCESS_REJECTED.
Bug: 138529441
Test: Manual test
Change-Id: Iefabeb731b941f09fe1272ac7b7cd2feba75c8df
Merged-In: Iefabeb731b941f09fe1272ac7b7cd2feba75c8df
one
When there's no users' choice to tell us whether to share their
phonebook information to the Bluetooth device, set the phonebook access
permission to ACCESS_REJECTED.
Bug: 138529441
Test: Manual test
Change-Id: Iefabeb731b941f09fe1272ac7b7cd2feba75c8df
Merged-In: Iefabeb731b941f09fe1272ac7b7cd2feba75c8df
(cherry picked from commit 810c6d2117)
Check if the error stream has been removed first.
Also move some code in submitCaptureRequest so that access to
mConfiguredOutputs is within scope of mInterfaceLock, which
matches all other places accessing mConfiguredOutputs in the file.
Test: Camera CTS
Bug: 140374093, 140527066
Change-Id: I84921eb3a555f67a006548865f34502ab978e33b
DozeSensors and DozeTriggers have code that perform proximity
checks in slightly different ways. DozeSensors was updated as
part of ag/9185335 bug DozeTriggers wasn't.
Bug: 9185335
Fixes: 140701062
Test: partially cover prox, send notification, look at screen
Change-Id: Ic85181abb3edd4c77c427faefa4cd6b9c35b498f
am: beb8996741 -s ours
am skip reason: change_id I2bce277ff8f2de4614e19d5385fe6712b076f9c9 with SHA1 a5e4422d14 is in history
Change-Id: Ie9d143876a093c760311c899249f2be8badabaf0
am: 81e2e1f105 -s ours
am skip reason: change_id I2bce277ff8f2de4614e19d5385fe6712b076f9c9 with SHA1 a5e4422d14 is in history
Change-Id: I0cff860765798db98867e14c2fde35807fc7e299
am: a6ce09aaec -s ours
am skip reason: change_id I2bce277ff8f2de4614e19d5385fe6712b076f9c9 with SHA1 a5e4422d14 is in history
Change-Id: I8b70e43d7ef03f0f86c75270508a6757d90c8561
Previous fix for b/126427214 would result that the target process
being inserted gets falling out of the "Activities" section. A
proper fix should be in the remove LRU process part.
Also fixed an issue during the update of client activities:
when the sub proc should be sitting at the end of the group,
ineeded it's getting inserted to a position before end index
which could be pointing to a different process group, therefore
the end result would be "mixed" group.
Bug: 139765319
Test: atest CtsAppTestCases:ServiceTest\#testActivityServiceBindingLru
manual: launch many apps and check the activity lru dump.
Change-Id: Ic56e38854837a07b8dabd1d19ba35eb1bfe4fd7a
Merged-In: Ic56e38854837a07b8dabd1d19ba35eb1bfe4fd7a
