Resolve account image icon profile boundary exploit.
Because Telecom grants the INTERACT_ACROSS_USERS permission, an exploit is possible where the user can upload an image icon (belonging to another user) via registering a phone account. This CL provides a lightweight solution for parsing the image URI to detect profile exploitation. Fixes: 273502295 Fixes: 296915211 Test: Unit test to enforce successful/failure path Change-Id: I2b6418f019a373ee9f02ba8683e5b694e7ab80a5 (cherry picked from commit d0d1d38e) Merged-In: I2b6418f019a373ee9f02ba8683e5b694e7ab80a5 (cherry picked from commit e7d0ca3f)
Loading
-
mentioned in commit 13980cb7
-
mentioned in commit 46031022
-
mentioned in commit 9bbf25ed
-
mentioned in commit a4bc335e
-
mentioned in commit 733a8f6b
-
mentioned in commit 4fd0e1e4
-
mentioned in commit 0f844fc0
-
mentioned in commit 3af8461c
-
mentioned in commit 03669b92
-
mentioned in commit db7db13a
-
mentioned in commit f62c4b46
-
mentioned in commit 25a966f6
-
mentioned in commit a496d3c7
-
mentioned in commit af9badc1
Please register or sign in to comment