BetterZUIKey v1.5.1

[CommandPrompt-Wang]

BetterZUIKey v1.5.1

[Please scroll down for English / 英语请向下滚动](l#eng)

摘要

本次为安全加固与代码清理版本，无新增功能。修复了配置 IPC 的一个越权隐患，并移除了一处冗余组件。

完整变更: 15-v1.5.0-beta1...16-v1.5.1

安全

• 配置 IPC 调用方校验：ConfigSyncProvider 现通过 Binder.getCallingUid() 校验调用方，仅放行 system_server 与模块自身。
  • 此前任意第三方应用可借 IPC 在模块进程中执行命令或覆写配置，现已阻断。

其他

• 命令输出脱敏：智能键脚本输出降级为 DEBUG 并截断（512 字符），不再全量写入 logcat。
• 队列解析重构：sys_write_queue 读写两端由手写 JSON 解析改为 Gson。
• 移除冗余组件：删除未使用的 RemotePrefProvider 与 remotepreferences 依赖，配置常量统一迁移至 ConfigSyncProvider。
• 健壮性：共享可变状态补 volatile；为空 catch 补充了 DEBUG 日志（受日志级别门控）；移除 system_server 侧无效的配置写盘调用。

---

BetterZUIKey v1.5.1

Highlights

A security hardening and code cleanup release with no new features. Fixes an IPC authorization flaw and removes a redundant component.

Full Changelog: 15-v1.5.0-beta1...16-v1.5.1

Security

• Config IPC caller validation: ConfigSyncProvider now validates the caller via Binder.getCallingUid(), allowing only system_server and the module itself.
  • Previously any third-party app could execute commands or overwrite config in the module process via IPC. This is now blocked.

Other

• Command output sanitization: Smart-key script output is downgraded to DEBUG and truncated (512 chars), no longer dumped in full to logcat.
• Queue parsing refactor: sys_write_queue read/write now uses Gson instead of hand-rolled JSON parsing.
• Removed redundant component: Dropped the unused RemotePrefProvider and the remotepreferences dependency; config constants migrated to ConfigSyncProvider.
• Robustness: Added volatile to shared mutable state; added DEBUG logging to empty catch blocks (gated by log level); removed ineffective config writes on the system_server side.

---

This discussion was created from the release BetterZUIKey v1.5.1.