instacart / instacart/truetime-android
DiskCacheClient.isTrueTimeCachedFromAPreviousBoot boot time change check flaw
- Dominant language
- Kotlin
- Stars
- 1.5k
- Forks
- 196
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/instacart/truetime-android/blob/a59e52528afa37087b1e7c7c9d79f54feb0c1825/library/src/main/java/com/instacart/library/truetime/DiskCacheClient.java#L58-L72
This method has a serious flaw. I'll start by providing a sequence of action scenario, **Base** and **Scenario A**, and finally **Scenario B**
## Base
Phone boots
App launches
`requestTime` is fired and the `deviceUptime` is cached at `10` seconds (easy round numbers for simplicity)
`cachedDeviceUptime = 10`
## Scenario A
Assuming the events of `Base` occurred first, imagine the following actions
Phone reboot
5 seconds later app is launched and truetime is `initialize()`
`cachedDeviceUptime` is still `10`.
`elapsedTime` is `5`
`5 < 10` is `true` thus `isTrueTimeCachedFromAPreviousBoot` returns false, thus truetime is not initialized as expected.
## Scenario B
This scenario exposes the flaw. Let's assume that the previous actions came from **Base** (Ignore **Scenario A**)
Phone reboots
20 seconds later app is launched and truetime is `initialize()`
`cachedDeviceUptime` is `10`.
`elapsedTime` is `20`
`20 < 10` is `false` thus `isTrueTimeCachedFromAPreviousBoot` returns true, thus truetime is initialized using old and stale cached data.
This does relate to #85 somewhat. This is mostly an issue if the boot receiver for some reason does not broadcast the boot event to the application (say if the application is in a **stopped** state after a force-close).
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.