pff: permission spoofing - calendar (Instances)

Change-Id: Idd87a288ae856ef023c63d432814ce2a3db42310
guhl · Jan 8, 2014 · b83e826 · b83e826
1 parent 7da62a3
commit b83e826
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 7 deletions.
diff --git a/core/java/android/content/ContentProvider.java b/core/java/android/content/ContentProvider.java
@@ -36,6 +36,8 @@
 import android.os.ParcelFileDescriptor;
 import android.os.Process;
 import android.os.UserHandle;
+import android.provider.CalendarContract;
+import android.text.format.Time;
 import android.util.Log;
 
 import java.io.File;
@@ -182,7 +184,7 @@ class Transport extends ContentProviderNative {
         int mWriteOp = AppOpsManager.OP_NONE;
 
         static final String PFF_LOG_TAG = "PFF_CONTENT_PROVIDER_TRANSPORT";
-    	static final int pff_dbg_level = 1;
+    	static final int pff_dbg_level = 3;
 
         ContentProvider getContentProvider() {
             return ContentProvider.this;
@@ -226,12 +228,24 @@ public Cursor query(String callingPkg, Uri uri, String[] projection,
 	                                                              ", getSchemeSpecificPart()"+uri.getSchemeSpecificPart()+
 	                                                              ", getQuery()"+uri.getQuery()+
 	                                                              ", limit="+limit);}	  
-	                    if (limit!=null){
-	                        builder.clearQuery();
-	                        if (pff_dbg_level>=3) {Log.d(PFF_LOG_TAG, "query: builder.clearQuery() -> builder.build()="+builder.build());}
-	                    }
-                            builder.appendQueryParameter("limit", String.valueOf(0));
-	                    uri=builder.build();
+	                    if (authority.equals(CalendarContract.AUTHORITY)){
+		                if (pff_dbg_level>=3) {Log.d(PFF_LOG_TAG, "query: authority.equals(CalendarContract.AUTHORITY)");}
+			        if (path.contains("/instances")){
+			            builder = CalendarContract.Instances.CONTENT_URI.buildUpon();
+                                    int JD = Time.getJulianMondayFromWeeksSinceEpoch(1);
+                                    ContentUris.appendId(builder, JD);
+                                    ContentUris.appendId(builder, JD);
+                                    uri=builder.build();
+                                } else {
+                                    builder = uri.buildUpon();
+                                    if (limit!=null){
+                                        builder.clearQuery();
+                                        if (pff_dbg_level>=3) {Log.d(PFF_LOG_TAG, "query: builder.clearQuery() -> builder.build()="+builder.build());}
+                                    }
+                                    builder.appendQueryParameter("limit", String.valueOf(0));
+                                    uri=builder.build();
+                                }
+                            }
 	                    if (pff_dbg_level>=2) {Log.d(PFF_LOG_TAG, "query: uri is: "+uri);}
 	                }
                     }

diff --git a/core/res/res/xml/spoofed_permissions.xml b/core/res/res/xml/spoofed_permissions.xml
@@ -9,4 +9,5 @@ If you add anything here make sure that the implementation DO support protecting
 	<item name="android.permission.ACCESS_FINE_LOCATION" />
 	<item name="android.permission.READ_CONTACTS" />
 	<item name="android.permission.READ_CALL_LOG" />
+	<item name="android.permission.READ_CALENDAR" />
 </spoofed-perms>