Access Control: Android Provider

Without proper access control, executing a SQLite statement that contains a user-controlled primary key can allow an attacker to view unauthorized records.

Access control errors occur in SQLite queries when:

1. Data enters a program from an untrusted source.


2. The data is used to specify the value of a primary key in a SQLite query.
Example 1: The following code uses a parameterized statement, which escapes metacharacters and prevents query string injection vulnerabilities, to construct and execute a SQLite query that searches for an invoice that matches a user-specified identifier.

  ...
  id = this.getIntent().getExtras().getInt("id");
  cursor = db.query(Uri.parse(invoices), columns, "id = ? ", {id}, null, null, null);
  ...
  

The problem is that the developer has failed to consider all of the possible values of id. Although the query generates a list of invoice identifiers that belong to the current user, an attacker might bypass this behavior to request any desired invoice. Because the code in this example does not ensure that the user has permission to access the requested invoice, it will display any invoice, even if it does not belong to the current user.