From 4dfa0cdaa7539d8d33f0a1df9c7b78ed6dbf00e6 Mon Sep 17 00:00:00 2001
From: Fyodor Kupolov <fkupolov@google.com>
Date: Mon, 26 Mar 2018 15:49:03 -0700
Subject: Check caller before accessing database

Test: Manual using PoC app
Bug: 75298708
Change-Id: I9e495fd94588e9a3fccfa2da1a9a7fcfd7f2ffa7
(cherry picked from commit 136dc9b3b628493e32446325de39b10d9bc5cb77)
---
 .../userdictionary/UserDictionaryProvider.java     | 30 +++++++++++-----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/src/com/android/providers/userdictionary/UserDictionaryProvider.java b/src/com/android/providers/userdictionary/UserDictionaryProvider.java
index c0f67e9..5abeefa 100644
--- a/src/com/android/providers/userdictionary/UserDictionaryProvider.java
+++ b/src/com/android/providers/userdictionary/UserDictionaryProvider.java
@@ -152,6 +152,11 @@ public class UserDictionaryProvider extends ContentProvider {
     @Override
     public Cursor query(Uri uri, String[] projection, String selection, String[] selectionArgs,
             String sortOrder) {
+        // Only the enabled IMEs and spell checkers can access this provider.
+        if (!canCallerAccessUserDictionary()) {
+            return getEmptyCursorOrThrow(projection);
+        }
+
         SQLiteQueryBuilder qb = new SQLiteQueryBuilder();
 
         switch (sUriMatcher.match(uri)) {
@@ -170,11 +175,6 @@ public class UserDictionaryProvider extends ContentProvider {
                 throw new IllegalArgumentException("Unknown URI " + uri);
         }
 
-        // Only the enabled IMEs and spell checkers can access this provider.
-        if (!canCallerAccessUserDictionary()) {
-            return getEmptyCursorOrThrow(projection);
-        }
-
         // If no sort order is specified use the default
         String orderBy;
         if (TextUtils.isEmpty(sortOrder)) {
@@ -257,6 +257,11 @@ public class UserDictionaryProvider extends ContentProvider {
 
     @Override
     public int delete(Uri uri, String where, String[] whereArgs) {
+        // Only the enabled IMEs and spell checkers can access this provider.
+        if (!canCallerAccessUserDictionary()) {
+            return 0;
+        }
+
         SQLiteDatabase db = mOpenHelper.getWritableDatabase();
         int count;
         switch (sUriMatcher.match(uri)) {
@@ -274,11 +279,6 @@ public class UserDictionaryProvider extends ContentProvider {
                 throw new IllegalArgumentException("Unknown URI " + uri);
         }
 
-        // Only the enabled IMEs and spell checkers can access this provider.
-        if (!canCallerAccessUserDictionary()) {
-            return 0;
-        }
-
         getContext().getContentResolver().notifyChange(uri, null);
         mBackupManager.dataChanged();
         return count;
@@ -286,6 +286,11 @@ public class UserDictionaryProvider extends ContentProvider {
 
     @Override
     public int update(Uri uri, ContentValues values, String where, String[] whereArgs) {
+        // Only the enabled IMEs and spell checkers can access this provider.
+        if (!canCallerAccessUserDictionary()) {
+            return 0;
+        }
+
         SQLiteDatabase db = mOpenHelper.getWritableDatabase();
         int count;
         switch (sUriMatcher.match(uri)) {
@@ -303,11 +308,6 @@ public class UserDictionaryProvider extends ContentProvider {
                 throw new IllegalArgumentException("Unknown URI " + uri);
         }
 
-        // Only the enabled IMEs and spell checkers can access this provider.
-        if (!canCallerAccessUserDictionary()) {
-            return 0;
-        }
-
         getContext().getContentResolver().notifyChange(uri, null);
         mBackupManager.dataChanged();
         return count;
-- 
cgit v1.2.3