)]}'
{
  "commit": "ff65257bd07c791a5bfef2f54bf96ae224c03273",
  "tree": "f3a9e78e901f702e4173143085f8222e1bd7460f",
  "parents": [
    "dcd82507688cadbde4c9d2036b244fe7304118d6"
  ],
  "author": {
    "name": "Patrick Rohr",
    "email": "prohr@google.com",
    "time": "Fri Dec 20 09:52:33 2024 -0800"
  },
  "committer": {
    "name": "Patrick Rohr",
    "email": "prohr@google.com",
    "time": "Mon Jan 06 13:57:49 2025 -0800"
  },
  "message": "Add missing permission check to offerNetwork\n\nThe missing permission check means that an unauthorized app could\nhave registered a network offer to intercept all NetworkRequests (by\ntrivially guessing an existing provider ID) which would have leaked\ninformation about other apps on the system.\n\nThis adds a NETWORK_FACTORY or MAINLINE_NETWORK_STACK permission check\nto offerNetwork per the API annotations in ConnectivityManager.\nTest networks can be offered when holding the MANAGE_TEST_NETWORKS\npermission which is consistent with similar APIs in this class.\n\nThere can be no legitimate use of this API a) offerNetwork is @hide\nand only exposed via NetworkProvider, and b) it requires getting a\nprovider ID by calling registerNetworkProvider which correctly enforces\npermissions.\n\nunofferNetwork does not currently require any permissions. Again, this\nis consistent with the API annotations in ConnectivityManager.\n\nTest: TH\nChange-Id: If71ce012f927a34c647d36b5eaf3723de2c01879\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "bad7246fb28e2256bbe4afa5ac4b5a89845947f8",
      "old_mode": 33188,
      "old_path": "service/src/com/android/server/ConnectivityService.java",
      "new_id": "544d309037abfb8d2434c4a4319be7dee7d62100",
      "new_mode": 33188,
      "new_path": "service/src/com/android/server/ConnectivityService.java"
    }
  ]
}