tree 6e39138ec6d2c946428fd8bd2052aed6dca2d6e9
parent 6d5e5d9ab2899f34984fc5ebfcd98c9201f9c3d5
author Tsung-Mao Fang <tmfang@google.com> 1618386697 +0800
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> 1625137276 +0000

Prevent HTML Injection on the Device Admin request screen

The root issue is that CharSequence is an interface.
String implements that interface, however, Spanned class
too which is a rich text format that can store HTML code.

The solution is enforce to use String type which won't include
any HTML function.

Test: Rebuilt apk and see the string without HTML style.
Bug: 179042963
Change-Id: I53b460b12da918e022d2f2934f114d205dbaadb0
Merged-In: I53b460b12da918e022d2f2934f114d205dbaadb0
(cherry picked from commit 0bf3c98b2f325f70d5492a7c7ade16951a802600)
(cherry picked from commit 52f9039d5cc775a02dab90492cca98850a82872a)