ContentProviderSecurityChecker 8.16.0 API

@ApiStatus.Internal() 
public final class ContentProviderSecurityChecker

Constructor Summary

Constructors
Constructor	Description
`ContentProviderSecurityChecker()`
`ContentProviderSecurityChecker(BuildInfoProvider buildInfoProvider)`

Method Summary

Modifier and Type	Method	Description
`void`	`checkPrivilegeEscalation(@NotNull() ContentProvider contentProvider)`	Protects against "Privilege Escalation via Content Provider" (CVE-2018-9492).

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - ContentProviderSecurityChecker
```
ContentProviderSecurityChecker()
```
  - ContentProviderSecurityChecker
```
ContentProviderSecurityChecker(BuildInfoProvider buildInfoProvider)
```
- Method Detail
  - checkPrivilegeEscalation
```
 void checkPrivilegeEscalation(@NotNull() ContentProvider contentProvider)
```
    Protects against "Privilege Escalation via Content Provider" (CVE-2018-9492).
    Throws a SecurityException if the security check is breached.
    See https://www.cvedetails.com/cve/CVE-2018-9492/ andhttps://github.com/getsentry/sentry-java/issues/2460
    Call this function in the ContentProvider's implementations of the abstractfunctions; query, insert, update, and delete.
    This should be invoked regardless of whether there is data to read/write or not. The attackis not contained to the specific provider but rather the entire system.
    This blocks the attacker by only allowing the app itself (not other apps) to interact withthe ContentProvider. If the ContentProvider needs to be able to interact with other trustedapps, then this function or class should be refactored to accommodate that.
    The vulnerability is specific to un-patched versions of Android 8 and 9 (API 26 to 28).Therefore, this security check is limited to those versions to mitigate risk of regression.