Exported provider permissions - readPermission/writePermission overlooked
- Dominant language
- Python
- Stars
- 3.4k
- Forks
- 663
- PR merge metrics
- No merged PRs in 30d
Description
When checking exported providers in the Application Manifest, QARK checks for the `android:permission` flag. If it can't find it, it assumes the provider is not protected by a permission. However, you can use `android:readPermission` and `android:writePermission` to set the individual read/write permissions. QARK should check the presence of these attributes if no android:permission is found.
http://developer.android.com/guide/topics/manifest/provider-element.html
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at QARK's Application Manifest provider-permission check and compare its handling of android:permission with the Android provider-element documentation linked in the issue. Trace the exported-provider check and verify that readPermission and writePermission are considered when the general permission is absent; done means those protected providers are no longer reported as unprotected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, python
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100