commit a6a449da07ee1bb28cb76d472b0fd33b3fa1fa17
author Willie Koomson <wvk@google.com> Tue Oct 29 21:55:42 2024 +0000
committer Willie Koomson <wvk@google.com> Tue Nov 12 22:12:09 2024 +0000
tree 37932fbcd18acca1eb9699f405abc2bd677be243
parent b287108b9522991fc166f7bb33b156a13215ec21

Check that widget provider can access RemoteViews URIs

This change responds to a security issue with privileged hosts with
INTERACT_ACROSS_USERS permissions displaying URIs from non-privileged
providers that the provider should not have access to.

Bug: 369137473
Test: Use playground app from bug
Test: atest "CtsAppWidgetTestCases:AppWidgetTest#testCheckRemoteViewsUri"
Flag: android.appwidget.flags.check_remote_views_uri_permission

Change-Id: I9c3f3b0799d2ebdd7a63a54bd2818a6bf37b6e60