am 284f7164: Do not allow updates to the _data column.

* commit '284f71646d1953f2d78b53e2cdb42cb93e1d9d6f':
  Do not allow updates to the _data column.

2 files changed, 33 insertions, 3 deletions

diff --git a/src/com/android/providers/contacts/VoicemailContentTable.java b/src/com/android/providers/contacts/VoicemailContentTable.java
index 3b72653a..5cfbca79 100644
--- a/src/com/android/providers/contacts/VoicemailContentTable.java
+++ b/src/com/android/providers/contacts/VoicemailContentTable.java
@@ -38,6 +38,8 @@ import android.provider.OpenableColumns;
 import android.provider.VoicemailContract.Voicemails;
 import android.util.Log;
 
+import com.google.common.collect.ImmutableSet;
+
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.IOException;
@@ -54,6 +56,21 @@ public class VoicemailContentTable implements VoicemailTable.Delegate {
 
     private static final String[] FILENAME_ONLY_PROJECTION = new String[] { Voicemails._DATA };
 
+    private static final ImmutableSet<String> ALLOWED_COLUMNS = new ImmutableSet.Builder<String>()
+            .add(Voicemails._ID)
+            .add(Voicemails.NUMBER)
+            .add(Voicemails.DATE)
+            .add(Voicemails.DURATION)
+            .add(Voicemails.IS_READ)
+            .add(Voicemails.STATE)
+            .add(Voicemails.SOURCE_DATA)
+            .add(Voicemails.SOURCE_PACKAGE)
+            .add(Voicemails.HAS_CONTENT)
+            .add(Voicemails.MIME_TYPE)
+            .add(OpenableColumns.DISPLAY_NAME)
+            .add(OpenableColumns.SIZE)
+            .build();
+
     private final String mTableName;
     private final SQLiteOpenHelper mDbHelper;
     private final Context mContext;
@@ -211,8 +228,10 @@ public class VoicemailContentTable implements VoicemailTable.Delegate {
     @Override
     public int update(UriData uriData, ContentValues values, String selection,
             String[] selectionArgs) {
-        checkForSupportedColumns(mVoicemailProjectionMap, values);
+
+        checkForSupportedColumns(ALLOWED_COLUMNS, values, "Updates are not allowed.");
         checkUpdateSupported(uriData);
+
         final SQLiteDatabase db = mDbHelper.getWritableDatabase();
         // TODO: This implementation does not allow bulk update because it only accepts
         // URI that include message Id. I think we do want to support bulk update.
diff --git a/src/com/android/providers/contacts/util/DbQueryUtils.java b/src/com/android/providers/contacts/util/DbQueryUtils.java
index c853a961..2b976a1a 100644
--- a/src/com/android/providers/contacts/util/DbQueryUtils.java
+++ b/src/com/android/providers/contacts/util/DbQueryUtils.java
@@ -20,6 +20,7 @@ import android.database.DatabaseUtils;
 import android.text.TextUtils;
 
 import java.util.HashMap;
+import java.util.Set;
 
 /**
  * Static methods for helping us build database query selection strings.
@@ -83,14 +84,24 @@ public class DbQueryUtils {
     /**
      * Checks if the given ContentValues contains values within the projection
      * map.
+     *
      * @throws IllegalArgumentException if any value in values is not found in
      * the projection map.
      */
     public static void checkForSupportedColumns(HashMap<String, String> projectionMap,
             ContentValues values) {
+        checkForSupportedColumns(projectionMap.keySet(), values, "Is invalid.");
+    }
+
+    /**
+     * @see #checkForSupportedColumns(HashMap, ContentValues)
+     */
+    public static void checkForSupportedColumns(Set<String> allowedColumns, ContentValues values,
+            String msgSuffix) {
         for (String requestedColumn : values.keySet()) {
-            if (!projectionMap.keySet().contains(requestedColumn)) {
-                throw new IllegalArgumentException("Column '" + requestedColumn + "' is invalid.");
+            if (!allowedColumns.contains(requestedColumn)) {
+                throw new IllegalArgumentException("Column '" + requestedColumn + "'. " +
+                        msgSuffix);
             }
         }
     }