Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
  • Tsung-Mao Fang's avatar
    1c38b6fe
    Prevent HTML Injection on the Device Admin request screen · 1c38b6fe
    Tsung-Mao Fang authored
    The root issue is that CharSequence is an interface.
    String implements that interface, however, Spanned class
    too which is a rich text format that can store HTML code.
    
    The solution is enforce to use String type which won't include
    any HTML function.
    
    Test: Rebuilt apk and see the string without HTML style.
    Bug: 179042963
    Change-Id: I53b460b12da918e022d2f2934f114d205dbaadb0
    Merged-In: I53b460b12da918e022d2f2934f114d205dbaadb0
    (cherry picked from commit 80c3f6d4)
    1c38b6fe
    Prevent HTML Injection on the Device Admin request screen
    Tsung-Mao Fang authored
    The root issue is that CharSequence is an interface.
    String implements that interface, however, Spanned class
    too which is a rich text format that can store HTML code.
    
    The solution is enforce to use String type which won't include
    any HTML function.
    
    Test: Rebuilt apk and see the string without HTML style.
    Bug: 179042963
    Change-Id: I53b460b12da918e022d2f2934f114d205dbaadb0
    Merged-In: I53b460b12da918e022d2f2934f114d205dbaadb0
    (cherry picked from commit 80c3f6d4)
Loading