commit f097b16cfddce2dbb097b929458fe9b0a402963e
author Nick Kralevich <nnk@google.com> Sat Jul 28 12:43:48 2012 -0700
committer Nick Kralevich <nnk@google.com> Tue Aug 07 11:34:00 2012 -0700
tree c49ca2a2c9475e5d0f1980960df5efe1d3cdd237
parent 6624afe37b3be7c469a3613298a2246663a2d409

Content Providers: change default for android:exported

Change the default value of android:exported to true
for applications which target a newer API version.
This will help stop inadvertent content provider
exposure to untrusted apps.

Bug: 3306452

Change-Id: I8cb34e823aef9551319951ce92217345c54cee63

core/java/android/content/pm/PackageParser.java

diff --git a/core/java/android/content/pm/PackageParser.java b/core/java/android/content/pm/PackageParser.java
index 3ce7c78..64b227b 100644
--- a/core/java/android/content/pm/PackageParser.java
+++ b/core/java/android/content/pm/PackageParser.java
@@ -2428,8 +2428,28 @@
             return null;
         }
 
+        boolean providerExportedDefault = false;
+
+        if (owner.applicationInfo.targetSdkVersion < Build.VERSION_CODES.JELLY_BEAN_MR1) {
+            // For compatibility, applications targeting API level 16 or lower
+            // should have their content providers exported by default, unless they
+            // specify otherwise.
+            providerExportedDefault = true;
+        }
+
+        if (((owner.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) != 0)
+            && (owner.applicationInfo.targetSdkVersion == Build.VERSION_CODES.JELLY_BEAN)) {
+            // STOPSHIP: REMOVE THIS IF BLOCK
+            // To expose more bugs, pre-installed system apps targeting API level 16
+            // should not have their content providers exported by default.
+            // This is only a short term check, and should be removed when the
+            // default SDK version changes to 17.
+            providerExportedDefault = false;
+        }
+
         p.info.exported = sa.getBoolean(
-                com.android.internal.R.styleable.AndroidManifestProvider_exported, true);
+                com.android.internal.R.styleable.AndroidManifestProvider_exported,
+                providerExportedDefault);
 
         String cpname = sa.getNonConfigurationString(
                 com.android.internal.R.styleable.AndroidManifestProvider_authorities, 0);
@@ -2487,7 +2507,7 @@
         }
         
         if (cpname == null) {
-            outError[0] = "<provider> does not incude authorities attribute";
+            outError[0] = "<provider> does not include authorities attribute";
             return null;
         }
         p.info.authority = cpname.intern();