)]}'
{
  "commit": "17dd11248a66b2722aa3ef07701b7f09a64160e5",
  "tree": "9dc14a4bc1e1b26bc2a0e617e211facad53363c5",
  "parents": [
    "a7245613009e19d83a43c2bad50beba58145c920"
  ],
  "author": {
    "name": "Lokesh Kumar Goel",
    "email": "lokeshgoel@google.com",
    "time": "Tue Feb 27 23:05:05 2024 +0000"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Wed Apr 10 21:56:19 2024 +0000"
  },
  "message": "Fix vulnerability in AttributionSource due to incorrect Binder call\n\nAttributionSource uses Binder.getCallingUid to verify the UID of the\ncaller from another process. However, getCallingUid does not always\nbehave as expected. If the AttributionSource is unparceled outside a\ntransaction thread, which is quite possible, getCallingUid will return\nthe UID of the current process instead. If this is a system process,\nthe UID check gets bypassed entirely, meaning any uid can be provided.\n\nThis patch fixes the vulnerability by emptying out the state of the\nAttributionSource, so that the service checking its credentials will\nfail to give permission to the app.\n\nBug: 267231571\nTest: v2/android-virtual-infra/test_mapping/presubmit-avd\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5d79e535b9a802680062545e15fc1faaf779c0bf)\nMerged-In: I3f228064fbd62e1c907f1ebe870cb61102f788f0\nChange-Id: I3f228064fbd62e1c907f1ebe870cb61102f788f0\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3f2fa2188d24793934c219d39505d836c2bdb333",
      "old_mode": 33188,
      "old_path": "core/java/android/content/AttributionSource.java",
      "new_id": "16b18c85e79085f99c9c60a53be4481537d9bbdf",
      "new_mode": 33188,
      "new_path": "core/java/android/content/AttributionSource.java"
    }
  ]
}