Extend SQLiteQueryBuilder for update and delete.
Developers often accept selection clauses from untrusted code, and SQLiteQueryBuilder already supports a "strict" mode to help catch SQL injection attacks. This change extends the builder to support update() and delete() calls, so that we can help secure those selection clauses too. Extend it to support selection arguments being provided when appending appendWhere() clauses, meaning developers no longer need to manually track their local selection arguments along with remote arguments. Extend it to support newer ContentProvider.query() variant that accepts "Bundle queryArgs", and have all query() callers flow through that common code path. (This paves the way for a future CL that will offer to gracefully extract non-WHERE clauses that callers have tried smashing into their selections.) Updates ContentValues to internally use more efficient ArrayMap. Bug: 111268862 Test: atest frameworks/base/core/tests/utiltests/src/com/android/internal/util/ArrayUtilsTest.java Test: atest cts/tests/tests/database/src/android/database/sqlite/cts/SQLiteQueryBuilderTest.java Change-Id: I60b6f69045766bb28d2f21a32c120ec8c383b917
Loading
Please register or sign in to comment