Files
frameworks_base/core/tests/coretests
Jeff Sharkey 216bbc2a2e RESTRICT AUTOMERGE
Strict SQLiteQueryBuilder needs to be stricter.

Malicious callers can leak side-channel information by using
subqueries in any untrusted inputs where SQLite allows "expr" values.

This change offers setStrictGrammar() to prevent this by outright
blocking subqueries in WHERE and HAVING clauses, and by requiring
that GROUP BY and ORDER BY clauses be composed only of valid columns.

This change also offers setStrictColumns() to require that all
untrusted column names are valid, such as those in ContentValues.

Relaxes to always allow aggregation operators on returned columns,
since untrusted callers can always calculate these manually.

Bug: 135270103
Bug: 135269143
Test: atest android.database.sqlite.cts.SQLiteQueryBuilderTest
Test: atest FrameworksCoreTests:android.database.sqlite.SQLiteTokenizerTest
Exempt-From-Owner-Approval: already approved in downstream branch
Change-Id: I6290afd19c966a8bdca71c377c88210d921a9f25
2019-09-12 19:59:17 +00:00
..
2018-02-23 18:17:15 -08:00
2019-09-12 19:59:17 +00:00
2018-04-06 14:54:39 +01:00

* Copyright (C) 2016 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
*      http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.


INTRODUCTION

The Android platform core tests (APCT) consist of unit tests for core platform
functionality. These differ from CTS in that they are not necessarily testing
public APIs and are not guaranteed to work outside of AOSP builds.


INSTRUCTIONS

To run a test or set of tests, first build the FrameworksCoreTests package:

  make FrameworksCoreTests

Next, install the resulting APK and run tests as you would normal JUnit tests:

  adb install -r ${ANDROID_PRODUCT_OUT}/data/app/FrameworksCoreTests/FrameworksCoreTests.apk
  adb shell am instrument -w \
    com.android.frameworks.coretests/android.support.test.runner.AndroidJUnitRunner

To run a tests within a specific package, add the following argument AFTER -w:

    -e package android.content.pm

To run a specific test or method within a test:

    -e class android.content.pm.PackageParserTest
    -e class android.content.pm.PackageParserTest#testComputeMinSdkVersion

To run tests in debug mode:

    -e debug true

To uninstall the package:

  adb shell pm uninstall -k com.android.frameworks.coretests

For more arguments, see the guide to command=line testing:

  https://developer.android.com/studio/test/command-line.html