commit 8bf272b44d91be76f227fb4d051e92ad89467901
author Amit Mahajan <amitmahajan@google.com> Wed Oct 28 13:43:01 2015 -0700
committer Jack Yu <jackyu@google.com> Wed Dec 09 20:48:09 2015 -0800
tree d053bf5052b14a62ca309237b2a45e0d645a527e
parent 24233d439e8efba5c9424ffc118781fbfb154db3

Validate the uri received in ApnEditor.

Uri should only refer to telephony carriers and no other provider.

Bug: 11184401
Change-Id: I38c25a37a48883f971c4f405a98db5066a707909

src/com/android/settings/ApnEditor.java

diff --git a/src/com/android/settings/ApnEditor.java b/src/com/android/settings/ApnEditor.java
index 8299c67..1a14ffe 100644
--- a/src/com/android/settings/ApnEditor.java
+++ b/src/com/android/settings/ApnEditor.java
@@ -203,10 +203,22 @@
         mFirstTime = icicle == null;
 
         if (action.equals(Intent.ACTION_EDIT)) {
-            mUri = intent.getData();
+            Uri uri = intent.getData();
+            if (!uri.isPathPrefixMatch(Telephony.Carriers.CONTENT_URI)) {
+                Log.e(TAG, "Edit request not for carrier table. Uri: " + uri);
+                finish();
+                return;
+            }
+            mUri = uri;
         } else if (action.equals(Intent.ACTION_INSERT)) {
             if (mFirstTime || icicle.getInt(SAVED_POS) == 0) {
-                mUri = getContentResolver().insert(intent.getData(), new ContentValues());
+                Uri uri = intent.getData();
+                if (!uri.isPathPrefixMatch(Telephony.Carriers.CONTENT_URI)) {
+                    Log.e(TAG, "Insert request not for carrier table. Uri: " + uri);
+                    finish();
+                    return;
+                }
+                mUri = getContentResolver().insert(uri, new ContentValues());
             } else {
                 mUri = ContentUris.withAppendedId(Telephony.Carriers.CONTENT_URI,
                         icicle.getInt(SAVED_POS));