diff options
| author | Jeff Sharkey <jsharkey@android.com> | 2018-07-16 13:18:04 -0600 |
|---|---|---|
| committer | Simon Shields <simon@lineageos.org> | 2018-10-30 12:33:17 +0100 |
| commit | 715c24acbe82ab1cc0dfe6be60dd0487d111dc46 (patch) | |
| tree | 4b24621989d0ed91a5348e9864ec0a43586c7cc0 /tests | |
| parent | b132242dc7f800c8e5444f6921a2689a101685a2 (diff) | |
| download | android_packages_providers_DownloadProvider-715c24acbe82ab1cc0dfe6be60dd0487d111dc46.tar.gz android_packages_providers_DownloadProvider-715c24acbe82ab1cc0dfe6be60dd0487d111dc46.tar.bz2 android_packages_providers_DownloadProvider-715c24acbe82ab1cc0dfe6be60dd0487d111dc46.zip | |
DO NOT MERGE. All untrusted selections must go through builder.
When accepting untrusted selections, they must be passed directly
to SQLiteQueryBuilder to ensure that setStrict() can be applied to
check for malicious callers sending unbalanced parentheses. This
means we can't mix local and remote selections; they always need to
be kept separate.
Use newly added SQLiteQueryBuilder functionality to apply strict
detection to update() and delete() calls.
Only allow the owner of a particular download to query the headers
for that download. Only delete headers for a download once we've
confirmed that caller can modify that download.
Test: atest packages/providers/DownloadProvider/tests/
Test: atest cts/tests/app/src/android/app/cts/DownloadManagerTest.java
Bug: 111085900
Change-Id: I9fd8e0d3cf80d7603bf0092f36fe449467090821
Merged-In: I9fd8e0d3cf80d7603bf0092f36fe449467090821
(cherry picked from commit 64b55ea82b1f394369237601ae1f1c78b776aabc)
Diffstat (limited to 'tests')
0 files changed, 0 insertions, 0 deletions