+1
−0
+524
−0
File added.
Preview size limit exceeded, changes collapsed.
+271
−0
File added.
Preview size limit exceeded, changes collapsed.
Loading
Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more
APIs working in the system_server and taking the package name as a parameter may have chance to reveal package existence status on the device, and break the package visibility we introduced in Android 11. Take an example of the API: `boolean setFoo(String packageName)`, a malicious app may have chance to detect package existence state on the device from the result of the API, if there is no package visibility filtering rule or uid identify checks applying to the parameter of the package name. To resolve the lint warning, you could apply package visibility filtering rules to the package name via PackageManagerInternal.filterAppAccess API, before starting to use the package name. If the parameter is a calling package name, using the PackageManager API such as PackageManager.getPackagesForUid to verify the calling identify. Bug: 228274845 Test: atest AndroidFrameworkLintCheckerTest --host Change-Id: I30ef6a184545d4704de8d26c7b1b62abb543c9d1
File added.
Preview size limit exceeded, changes collapsed.
File added.
Preview size limit exceeded, changes collapsed.