)]}'
{
  "commit": "a508a0a4dba6ec0825a8d77abeb64654e6f36824",
  "tree": "37880b8e6614c4fb5e85b22a523f6e946b3e5e75",
  "parents": [
    "03c1d8e340693ba4e3111932315ba01b0dd946ad"
  ],
  "author": {
    "name": "Josh Hou",
    "email": "joshhou@google.com",
    "time": "Sun May 24 09:54:16 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Fri Jul 10 08:10:35 2026 -0700"
  },
  "message": "Fix path traversal and missing ownership check in LocaleManagerService\n\nThe getOverrideLocaleConfig method in LocaleManagerService lacked an ownership\ncheck, allowing unauthorized cross-package and cross-user disclosure of\napp-specific locale configurations. Additionally, the packageName parameter was\nused to construct a file path without proper validation, enabling path traversal\nattacks.\n\nThis change adds the missing ownership and permission checks, ensuring that\nonly the app owner, installer, or apps with the READ_APP_SPECIFIC_LOCALES\npermission can access the configuration. It also validates that the constructed\nfile path remains within the intended directory to prevent path traversal, and logs blocked attempts to SafetyNet.\n\nBug: 495409704\nTest: atest LocaleManagerServiceTest and manual test\nFlag: EXEMPT BUGFIX\n\nTAG\u003dagy\nCONV\u003d1df5aed4-e067-499d-af15-55319a43c2f4\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:e4c79ddf98cb8874e2ed6dadc05712fc4be38d29\nMerged-In: I9a342686e569f529bb37d9c19eebbceb60f6aa9d\nChange-Id: I9a342686e569f529bb37d9c19eebbceb60f6aa9d\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "4851a81d3b6913022d4f417b28030a93b570bb34",
      "old_mode": 33188,
      "old_path": "services/core/java/com/android/server/locales/LocaleManagerService.java",
      "new_id": "1ac042614b711ca36f574dc448de4c20d9938e94",
      "new_mode": 33188,
      "new_path": "services/core/java/com/android/server/locales/LocaleManagerService.java"
    },
    {
      "type": "modify",
      "old_id": "4cfbb9520d5fc316672bbe065ff67c57c2e02b7a",
      "old_mode": 33188,
      "old_path": "services/tests/servicestests/src/com/android/server/locales/LocaleManagerServiceTest.java",
      "new_id": "425f720f1a8edfdd803cdcdb6dcc06690ac680ec",
      "new_mode": 33188,
      "new_path": "services/tests/servicestests/src/com/android/server/locales/LocaleManagerServiceTest.java"
    }
  ]
}