linkedin / linkedin/qark

Exported provider permissions - readPermission/writePermission overlooked

Open
#27 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
3.4k
Forks
663
PR merge metrics
No merged PRs in 30d

Description

When checking exported providers in the Application Manifest, QARK checks for the `android:permission` flag. If it can't find it, it assumes the provider is not protected by a permission. However, you can use `android:readPermission` and `android:writePermission` to set the individual read/write permissions. QARK should check the presence of these attributes if no android:permission is found.

http://developer.android.com/guide/topics/manifest/provider-element.html

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at QARK's Application Manifest provider-permission check and compare its handling of android:permission with the Android provider-element documentation linked in the issue. Trace the exported-provider check and verify that readPermission and writePermission are considered when the general permission is absent; done means those protected providers are no longer reported as unprotected.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, python
Domain
mobile, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.