diff options
| author | Jeff Sharkey <jsharkey@android.com> | 2019-12-18 17:55:39 -0700 |
|---|---|---|
| committer | Jeff Sharkey <jsharkey@android.com> | 2019-12-18 17:55:42 -0700 |
| commit | 19491026cafa107d8b5fe4a4abf0b875f042d6e0 (patch) | |
| tree | d8c9bdf2057840e4463f7d0dd99738f6c48a9071 /rs/java/android/renderscript/ProgramFragmentFixedFunction.java | |
| parent | 03c713106825d7854b4ca8ee9a563ca49ea4152a (diff) | |
We can't be as clever as we'd like.
We had hoped that SQLiteQueryBuilder could enforce some pretty strict
grammar rules, but there are apps depending on the full quirkiness
of what SQLite will allow, which is pretty much "expr" everywhere.
So we shift our strategy from a whitelist-style approach to a
blacklist-style one, where we're willing to let any valid keyword
be used _except_ for ones we know are rooted in abuse, such as
performing SELECT subqueries or relying on SQL injection to blur
the lines between well-defined clauses.
Bug: 146478800, 146482076
Test: atest --test-mapping packages/providers/MediaProvider
Change-Id: Ib57ceab0e229e01177cabd8277f3c989c817b10c
Diffstat (limited to 'rs/java/android/renderscript/ProgramFragmentFixedFunction.java')
0 files changed, 0 insertions, 0 deletions