fix: improve core:provider module security and correctness#1487
Open
fix: improve core:provider module security and correctness#1487
Conversation
- Fix bug where packageName was passed as component type in ShareCmpInfo - Add signature-level permission to protect exported ContentProvider - Extract magic strings to companion object constants - Return success/failure counts from controlComponent instead of raw input - Parse actual ComponentType from ShareCmpInfo instead of hardcoding ACTIVITY - Add unit tests for ShareCmpInfo serialization and AnalyticsExtension
- Revert signature permission since provider needs to be open to external apps - Use runBlocking(Dispatchers.IO) to avoid blocking the caller's thread
- Replace hardcoded Dispatchers.IO with @dispatcher(IO) from EntryPoint - Inject Json instance from Hilt graph instead of creating locally - Extract entryPoint() helper to reduce duplication - Move null checks before runBlocking to avoid unnecessary coroutine creation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
getBlockedComponents()was passingpackageNameto thetypefield ofShareCmpInfo.Component— now correctly passesit.type.namesignature-level permissionCONTROL_COMPONENTS"getComponents","blocks","cmp_list") extracted tocompanion objectconstants for reusabilitycontrolComponent()now returnssuccess_countandtotal_countinstead of echoing back the input bundleACTIVITY, now parses the realComponentTypefromShareCmpInfowith graceful fallbackShareCmpInfoTest(serialization round-trip) andAnalyticsExtensionTest(event logging verification)Test plan
./gradlew :core:provider:test— all tests pass./gradlew :core:provider:spotlessCheck— formatting clean