)]}'
{
  "commit": "ade14969dd4bb619e0eebe629911b009047d3e9b",
  "tree": "33eee2d239b2b7e175a6dda4e67e6b1cd332a105",
  "parents": [
    "c7dd9e5bcf31767b3f5db3bac8e006945dce8d10"
  ],
  "author": {
    "name": "Jeff Sharkey",
    "email": "jsharkey@android.com",
    "time": "Thu Jul 11 15:27:51 2019 -0600"
  },
  "committer": {
    "name": "Jeff Sharkey",
    "email": "jsharkey@android.com",
    "time": "Thu Jul 18 09:45:21 2019 -0600"
  },
  "message": "Strict SQLiteQueryBuilder needs to be stricter.\n\nMalicious callers can leak side-channel information by using\nsubqueries in any untrusted inputs where SQLite allows \"expr\" values.\n\nThis change offers setStrictGrammar() to prevent this by outright\nblocking subqueries in WHERE and HAVING clauses, and by requiring\nthat GROUP BY and ORDER BY clauses be composed only of valid columns.\n\nThis change also offers setStrictColumns() to require that all\nuntrusted column names are valid, such as those in ContentValues.\n\nRelaxes to always allow aggregation operators on returned columns,\nsince untrusted callers can always calculate these manually.\n\nBug: 135270103, 135269143\nTest: atest android.database.sqlite.cts.SQLiteQueryBuilderTest\nChange-Id: I49e643f5c57fb9d7e755190ccf4edf191313c28b\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2475af8ed7345936ccc3790b13316c1f9e5958b1",
      "old_mode": 33188,
      "old_path": "tests/tests/database/src/android/database/sqlite/cts/SQLiteQueryBuilderTest.java",
      "new_id": "f197968657a34c0551dc0fc0b9dee92d5eb1565c",
      "new_mode": 33188,
      "new_path": "tests/tests/database/src/android/database/sqlite/cts/SQLiteQueryBuilderTest.java"
    }
  ]
}