| commit | a65429742caf05205ea7f1c2fdd1119ca652b810 | [log] [tgz] |
|---|---|---|
| author | Ioana Alexandru <[email protected]> | Fri May 12 15:41:09 2023 +0000 |
| committer | Android Build Coastguard Worker <[email protected]> | Thu Jun 08 20:34:01 2023 +0000 |
| tree | dbc916cf18a3dff92d6814d4cd1650b84626c02e | |
| parent | 726247f4f53e8cc0746175265652fa415a123c0c [diff] |
Implement visitUris for RemoteViews ViewGroupActionAdd. This is to prevent a vulnerability where notifications can show resources belonging to other users, since the URI in the nested views was not being checked. Bug: 277740082 Test: atest RemoteViewsTest NotificationVisitUrisTest (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:850fd984e5f346645b5a941ed7307387c7e4c4de) Merged-In: I5c71f0bad0a6f6361eb5ceffe8d1e47e936d78f8 Change-Id: I5c71f0bad0a6f6361eb5ceffe8d1e47e936d78f8