summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--packages/WAPPushManager/src/com/android/smspush/WapPushManager.java30
-rw-r--r--packages/WAPPushManager/tests/src/com/android/smspush/unitTests/WapPushTest.java21
2 files changed, 42 insertions, 9 deletions
diff --git a/packages/WAPPushManager/src/com/android/smspush/WapPushManager.java b/packages/WAPPushManager/src/com/android/smspush/WapPushManager.java
index 96e0377..e970367 100644
--- a/packages/WAPPushManager/src/com/android/smspush/WapPushManager.java
+++ b/packages/WAPPushManager/src/com/android/smspush/WapPushManager.java
@@ -117,14 +117,18 @@ public class WapPushManager extends Service {
*/
protected queryData queryLastApp(SQLiteDatabase db,
String app_id, String content_type) {
- String sql = "select install_order, package_name, class_name, "
- + " app_type, need_signature, further_processing"
- + " from " + APPID_TABLE_NAME
- + " where x_wap_application=\'" + app_id + "\'"
- + " and content_type=\'" + content_type + "\'"
- + " order by install_order desc";
- if (DEBUG_SQL) Log.v(LOG_TAG, "sql: " + sql);
- Cursor cur = db.rawQuery(sql, null);
+ if (LOCAL_LOGV) Log.v(LOG_TAG, "queryLastApp app_id: " + app_id
+ + " content_type: " + content_type);
+
+ Cursor cur = db.query(APPID_TABLE_NAME,
+ new String[] {"install_order", "package_name", "class_name",
+ "app_type", "need_signature", "further_processing"},
+ "x_wap_application=? and content_type=?",
+ new String[] {app_id, content_type},
+ null /* groupBy */,
+ null /* having */,
+ "install_order desc" /* orderBy */);
+
queryData ret = null;
if (cur.moveToNext()) {
@@ -392,10 +396,20 @@ public class WapPushManager extends Service {
SQLiteDatabase db = dbh.getReadableDatabase();
WapPushManDBHelper.queryData lastapp = dbh.queryLastApp(db, x_app_id, content_type);
+ if (LOCAL_LOGV) Log.v(LOG_TAG, "verifyData app id: " + x_app_id + " content type: " +
+ content_type + " lastapp: " + lastapp);
+
db.close();
if (lastapp == null) return false;
+ if (LOCAL_LOGV) Log.v(LOG_TAG, "verifyData lastapp.packageName: " + lastapp.packageName +
+ " lastapp.className: " + lastapp.className +
+ " lastapp.appType: " + lastapp.appType +
+ " lastapp.needSignature: " + lastapp.needSignature +
+ " lastapp.furtherProcessing: " + lastapp.furtherProcessing);
+
+
if (lastapp.packageName.equals(package_name)
&& lastapp.className.equals(class_name)
&& lastapp.appType == app_type
diff --git a/packages/WAPPushManager/tests/src/com/android/smspush/unitTests/WapPushTest.java b/packages/WAPPushManager/tests/src/com/android/smspush/unitTests/WapPushTest.java
index f436cb4..5ae6589 100644
--- a/packages/WAPPushManager/tests/src/com/android/smspush/unitTests/WapPushTest.java
+++ b/packages/WAPPushManager/tests/src/com/android/smspush/unitTests/WapPushTest.java
@@ -552,6 +552,25 @@ public class WapPushTest extends ServiceTestCase<WapPushManager> {
}
/**
+ * Add sqlite injection test
+ */
+ public void testAddPackage0() {
+ String inject = "' union select 0,'com.android.settings','com.android.settings.Settings',0,0,0--";
+
+ // insert new data
+ IWapPushManager iwapman = getInterface();
+ try {
+ assertFalse(iwapman.addPackage(
+ inject,
+ Integer.toString(mContentTypeValue),
+ mPackageName, mClassName,
+ WapPushManagerParams.APP_TYPE_SERVICE, true, true));
+ } catch (RemoteException e) {
+ assertTrue(false);
+ }
+ }
+
+ /**
* Add duprecated package test.
*/
public void testAddPackage2() {
@@ -1477,7 +1496,7 @@ public class WapPushTest extends ServiceTestCase<WapPushManager> {
System.arraycopy(mWspHeader, 0, array,
mGsmHeader.length + mUserDataHeader.length, mWspHeader.length);
System.arraycopy(mMessageBody, 0, array,
- mGsmHeader.length + mUserDataHeader.length + mWspHeader.length,
+ mGsmHeader.length + mUserDataHeader.length + mWspHeader.length,
mMessageBody.length);
return array;