Content Provider URI Injection

Constructing a Content Provider query statement that contains user input can allow an attacker to access unauthorized records.

Query string injection vulnerabilities occur when:

1. Data enters a program from an untrusted source.



2. The data is used to dynamically construct a Content Provider query URI.



Android content providers enable developers to write queries without SQL by just building content provider URIs. Content provider query URIs are vulnerable to injection attacks and so developers should avoid using string concatenation with tainted data inputs to construct the URI, without ensuring that metacharacters are properly validated or encoded.

Example 1: Given an application that exposes several content providers at URIs:

content://my.authority/messagescontent://my.authority/messages/123content://my.authority/messages/deleted

If developers build the query URIs concatenating strings, then attackers will be able to include slashes in the path or other URI metacharacters that will change the meaning of the query. In the following code snippet, an attacker can invoke content://my.authority/messages/deleted by providing a msgId code with value deleted:

// "msgId" is submitted by users
Uri dataUri = Uri.parse(WeatherContentProvider.CONTENT_URI + "/" + msgId);
Cursor wCursor1 = getContentResolver().query(dataUri, null, null, null, null);