9046b84805
The security issue occurs because id is allowed to be an arbitrary path instead of being limited to what it is -- a long. Both id and account id are now parsed into longs (and if either fails, an error will be logged and null will be returned). Tested/verified error is logged using the reported attack. BUG=30745403 Change-Id: Ia21418545bbaeb96fb5ab6c3f4e71858e57b8684 (cherry picked from commit 9794d7e8216138adf143a3b6faf3d5683316a662) |
||
---|---|---|
.. | ||
activity/setup | ||
provider | ||
service | ||
setup | ||
AttachmentInfo.java | ||
DebugUtils.java | ||
EmailConnectivityManager.java | ||
EmailIntentService.java | ||
FixedLengthInputStream.java | ||
LegacyConversions.java | ||
NotificationController.java | ||
NotificationControllerCreator.java | ||
NotificationControllerCreatorHolder.java | ||
PeekableInputStream.java | ||
Preferences.java | ||
ResourceHelper.java | ||
SecurityPolicy.java |