@@ -126,8 +126,8 @@ applications.</p>
126126<p>Use of <a
127127href="{@docRoot}reference/android/content/Context.html#MODE_WORLD_WRITEABLE">
128128world writable</a> or <a
129- href="{@docRoot}reference/android/content/Context.html#MODE_WORLD_READABLE
130- ">world readable</a> files for IPC is discouraged because it does not provide
129+ href="{@docRoot}reference/android/content/Context.html#MODE_WORLD_READABLE">world
130+ readable</a> files for IPC is discouraged because it does not provide
131131the ability to limit data access to particular applications, nor does it
132132provide any control on data format. As an alternative, you might consider using
133133a ContentProvider which provides read and write permissions, and can make
@@ -199,10 +199,10 @@ ContentProvider</a></code>.</p>
199199<p>ContentProviders can also provide more granular access by declaring the <a
200200href="{@docRoot}guide/topics/manifest/provider-element.html#gprmsn">
201201grantUriPermissions</a> element and using the <code><a
202- href="{@docRoot}reference/android/content/Intent.html#FLAG_GRANT_READ_URI_PERMIS
203- SION">FLAG_GRANT_READ_URI_PERMISSION</a></code> and <code><a
204- href="{@docRoot}reference/android/content/Intent.html#FLAG_GRANT_WRITE_URI_PERMI
205- SSION">FLAG_GRANT_WRITE_URI_PERMISSION</a></code> flags in the Intent object
202+ href="{@docRoot}reference/android/content/Intent.html#FLAG_GRANT_READ_URI_PERMISSION">FLAG_GRANT_READ_URI_PERMISSION</a></code>
203+ and <code><a
204+ href="{@docRoot}reference/android/content/Intent.html#FLAG_GRANT_WRITE_URI_PERMISSION">FLAG_GRANT_WRITE_URI_PERMISSION</a></code>
205+ flags in the Intent object
206206that activates the component. The scope of these permissions can be further
207207limited by the <code><a
208208href="{@docRoot}guide/topics/manifest/grant-uri-permission-element.html">
@@ -211,14 +211,9 @@ grant-uri-permission element</a></code>.</p>
211211<p>When accessing a <code>
212212<a href="{@docRoot}reference/android/content/ContentProvider.html">
213213ContentProvider</a></code>, use parameterized query methods such as <code>
214- <a href="{@docRoot}reference/android/content/ContentProvider.html#query(android.net
215- .Uri,%20java.lang.String[],%20java.lang.String,%20java.lang.String[],%20java.lan
216- g.String)">query()</a></code>, <code><a
217- href="{@docRoot}reference/android/content/ContentProvider.html#update(android.ne
218- t.Uri,%20android.content.ContentValues,%20java.lang.String,%20java.lang.String[]
219- )">update()</a></code>, and <code><a
220- href="{@docRoot}reference/android/content/ContentProvider.html#delete(android.ne
221- t.Uri,%20java.lang.String,%20java.lang.String[])">delete()</a></code> to avoid
214+ <a href="{@docRoot}reference/android/content/ContentProvider.html#query(android.net.Uri,%20java.lang.String[],%20java.lang.String,%20java.lang.String[],%20java.lang.String)">query()</a></code>, <code><a
215+ href="{@docRoot}reference/android/content/ContentProvider.html#update(android.net.Uri,%20android.content.ContentValues,%20java.lang.String,%20java.lang.String[])">update()</a></code>, and <code><a
216+ href="{@docRoot}reference/android/content/ContentProvider.html#delete(android.net.Uri,%20java.lang.String,%20java.lang.String[])">delete()</a></code> to avoid
222217potential <a href="http://en.wikipedia.org/wiki/SQL_injection">SQL
223218Injection</a> from untrusted data. Note that using parameterized methods is not
224219sufficient if the <code>selection</code> is built by concatenating user data
@@ -249,8 +244,9 @@ href="{@docRoot}reference/android/R.styleable.html#AndroidManifestActivity">
249244Activities</a>, and <a
250245href="{@docRoot}reference/android/R.styleable.html#AndroidManifestService">
251246Services</a> are all declared in the application manifest. If your IPC mechanism is
252- not intended for use by other applications, set the android:exported property
253- to false. This is useful for applications that consist of multiple processes
247+ not intended for use by other applications, set the <a
248+ href="{@docRoot}guide/topics/manifest/service-element.html#exported">{@code android:exported}</a>
249+ property to false. This is useful for applications that consist of multiple processes
254250within the same UID, or if you decide late in development that you do not
255251actually want to expose functionality as IPC but you don’t want to rewrite
256252the code.</p>
@@ -276,11 +272,10 @@ activity.</p>
276272
277273<p>Intents are the preferred mechanism for asynchronous IPC in Android.
278274Depending on your application requirements, you might use <code><a
279- href="{@docRoot}reference/android/content/Context.html#sendBroadcast(android.con
280- tent.Intent)">sendBroadcast()</a></code>, <code><a
281- href="{@docRoot}reference/android/content/Context.html#sendOrderedBroadcast(andr
282- oid.content.Intent,%20java.lang.String)">sendOrderedBroadcast()</a></code>, or
283- direct an intent to a specific application component.</p>
275+ href="{@docRoot}reference/android/content/Context.html#sendBroadcast(android.content.Intent)">sendBroadcast()</a></code>,
276+ <code><a
277+ href="{@docRoot}reference/android/content/Context.html#sendOrderedBroadcast(android.content.Intent,%20java.lang.String)">sendOrderedBroadcast()</a></code>,
278+ or direct an intent to a specific application component.</p>
284279
285280<p>Note that ordered broadcasts can be “consumed” by a recipient, so they
286281may not be delivered to all applications. If you are sending an Intent where
@@ -311,14 +306,13 @@ and/or access controls on a specific binder interface, those controls must be
311306explicitly added as code in the interface.</p>
312307
313308<p>If providing an interface that does require access controls, use <code><a
314- href="{@docRoot}reference/android/content/Context.html#checkCallingPermission(ja
315- va.lang.String)">checkCallingPermission()</a></code> to verify whether the
309+ href="{@docRoot}reference/android/content/Context.html#checkCallingPermission(java.lang.String)">checkCallingPermission()</a></code>
310+ to verify whether the
316311caller of the Binder has a required permission. This is especially important
317312before accessing a Service on behalf of the caller, as the identify of your
318313application is passed to other interfaces. If invoking an interface provided
319314by a Service, the <code><a
320- href="{@docRoot}reference/android/content/Context.html#bindService(android.conte
321- nt.Intent,%20android.content.ServiceConnection,%20int)">bindService()</a></code>
315+ href="{@docRoot}reference/android/content/Context.html#bindService(android.content.Intent,%20android.content.ServiceConnection,%20int)">bindService()</a></code>
322316 invocation may fail if you do not have permission to access the given Service.
323317 If calling an interface provided locally by your own application, it may be
324318useful to use the <code><a
@@ -332,14 +326,14 @@ an intent.</p>
332326
333327<p>By default, receivers are exported and can be invoked by any other
334328application. If your <code><a
335- href={@docRoot}reference/android/content/BroadcastReceiver.html">
329+ href=" {@docRoot}reference/android/content/BroadcastReceiver.html">
336330BroadcastReceivers</a></code> is intended for use by other applications, you
337331may want to apply security permissions to receivers using the <code><a
338- href="{@docRoot}reference/android/R.styleable. html#AndroidManifestReceiver ">
332+ href="{@docRoot}guide/topics/manifest/receiver-element. html">
339333<receiver></a></code> element within the application manifest. This will
340334prevent applications without appropriate permissions from sending an intent to
341335the <code><a
342- href={@docRoot}reference/android/content/BroadcastReceiver.html">
336+ href=" {@docRoot}reference/android/content/BroadcastReceiver.html">
343337BroadcastReceivers</a></code>.</p>
344338
345339<h3>Using Services</h3>
@@ -349,19 +343,21 @@ use. Each service class must have a corresponding <service> declaration in its
349343package's AndroidManifest.xml.</p>
350344
351345<p>By default, Services are exported and can be invoked by any other
352- application. Services can be protected using the android:permission attribute
346+ application. Services can be protected using the <a
347+ href="{@docRoot}guide/topics/manifest/service-element.html#prmsn">{@code android:permission}</a>
348+ attribute
353349within the manifest’s <code><a
354- href="{@docRoot}reference/android/R.styleable. html#AndroidManifestService ">
350+ href="{@docRoot}guide/topics/manifest/service-element. html">
355351<service></a></code> tag. By doing so, other applications will need to declare
356352a corresponding <code><a
357- href="{@docRoot}reference/android/R.styleable. html#AndroidManifestService_permis
358- sion"><uses-permission></a> </code> element in their own manifest to be
353+ href="{@docRoot}guide/topics/manifest/uses-permission-element. html"><uses-permission></a>
354+ </code> element in their own manifest to be
359355able to start, stop, or bind to the service.</p>
360356
361357<p>A Service can protect individual IPC calls into it with permissions, by
362358calling <code><a
363- href="{@docRoot}reference/android/content/Context.html#checkCallingPermission(ja
364- va.lang.String)">checkCallingPermission()</a></code> before executing
359+ href="{@docRoot}reference/android/content/Context.html#checkCallingPermission(java.lang.String)">checkCallingPermission()</a></code>
360+ before executing
365361the implementation of that call. We generally recommend using the
366362declarative permissions in the manifest, since those are less prone to
367363oversight.</p>
@@ -376,9 +372,9 @@ Service to handle IPC, since this modular approach reduces the risk of exposing
376372functionality that is not intended for use by other applications.</p>
377373
378374<p>If you do expose an Activity for purposes of IPC, the <code><a
379- href="{@docRoot}reference/android/R.styleable. html#AndroidManifestActivity_permi
380- ssion">android:permission</a></code> attribute in the <code><a
381- href="{@docRoot}reference/android/R.styleable. html#AndroidManifestActivity ">
375+ href="{@docRoot}guide/topics/manifest/activity-element. html#prmsn">android:permission</a></code>
376+ attribute in the <code><a
377+ href="{@docRoot}guide/topics/manifest/activity-element. html">
382378<activity></a></code> declaration in the application manifest can be used to
383379restrict access to only those applications which have the stated
384380permissions.</p>
@@ -432,8 +428,8 @@ rkeley.edu/~afelt/felt_usenixsec2011.pdf</a></p>
432428<p>Generally, you should strive to create as few permissions as possible while
433429satisfying your security requirements. Creating a new permission is relatively
434430uncommon for most applications, since <a
435- href="{@docRoot}reference/android/Manifest.permission.html">
436- system-defined permissions</a> cover many situations. Where appropriate,
431+ href="{@docRoot}reference/android/Manifest.permission.html">system-defined
432+ permissions</a> cover many situations. Where appropriate,
437433perform access checks using existing permissions.</p>
438434
439435<p>If you must create a new permission, consider whether you can accomplish
@@ -560,31 +556,26 @@ href="{@docRoot}reference/android/webkit/WebView.html">WebView</a></code> does
560556not execute JavaScript so cross-site-scripting is not possible.</p>
561557
562558<p>Use <code><a
563- href="{@docRoot}reference/android/webkit/WebView.html#addJavascriptInterface(jav
564- a.lang.Object,%20java.lang.String)">addJavaScriptInterface()</a></code> with
559+ href="{@docRoot}reference/android/webkit/WebView.html#addJavascriptInterface(java.lang.Object,%20java.lang.String)">addJavaScriptInterface()</a></code> with
565560particular care because it allows JavaScript to invoke operations that are
566561normally reserved for Android applications. Only expose <code><a
567- href="{@docRoot}reference/android/webkit/WebView.html#addJavascriptInterface(jav
568- a.lang.Object,%20java.lang.String)">addJavaScriptInterface()</a></code> to
562+ href="{@docRoot}reference/android/webkit/WebView.html#addJavascriptInterface(java.lang.Object,%20java.lang.String)">addJavaScriptInterface()</a></code> to
569563sources from which all input is trustworthy. If untrusted input is allowed,
570564untrusted JavaScript may be able to invoke Android methods. In general, we
571565recommend only exposing <code><a
572- href="{@docRoot}reference/android/webkit/WebView.html#addJavascriptInterface(jav
573- a.lang.Object,%20java.lang.String)">addJavaScriptInterface()</a></code> to
566+ href="{@docRoot}reference/android/webkit/WebView.html#addJavascriptInterface(java.lang.Object,%20java.lang.String)">addJavaScriptInterface()</a></code> to
574567JavaScript that is contained within your application APK.</p>
575568
576569<p>Do not trust information downloaded over HTTP, use HTTPS instead. Even if
577570you are connecting only to a single website that you trust or control, HTTP is
578571subject to <a
579572href="http://en.wikipedia.org/wiki/Man-in-the-middle_attack">MiTM</a> attacks
580573and interception of data. Sensitive capabilities using <code><a
581- href="{@docRoot}reference/android/webkit/WebView.html#addJavascriptInterface(jav
582- a.lang.Object,%20java.lang.String)">addJavaScriptInterface()</a></code> should
574+ href="{@docRoot}reference/android/webkit/WebView.html#addJavascriptInterface(java.lang.Object,%20java.lang.String)">addJavaScriptInterface()</a></code> should
583575not ever be exposed to unverified script downloaded over HTTP. Note that even
584576with the use of HTTPS,
585577<code><a
586- href="{@docRoot}reference/android/webkit/WebView.html#addJavascriptInterface(jav
587- a.lang.Object,%20java.lang.String)">addJavaScriptInterface()</a></code>
578+ href="{@docRoot}reference/android/webkit/WebView.html#addJavascriptInterface(java.lang.Object,%20java.lang.String)">addJavaScriptInterface()</a></code>
588579increases the attack surface of your application to include the server
589580infrastructure and all CAs trusted by the Android-powered device.</p>
590581
@@ -683,8 +674,7 @@ discussed in the Requesting Permissions section.</p>
683674<p>If a GUID is required, create a large, unique number and store it. Do not
684675use phone identifiers such as the phone number or IMEI which may be associated
685676with personal information. This topic is discussed in more detail in the <a
686- href="http://android-developers.blogspot.com/2011/03/identifying-app-installatio
687- ns.html">Android Developer Blog</a>.</p>
677+ href="http://android-developers.blogspot.com/2011/03/identifying-app-installations.html">Android Developer Blog</a>.</p>
688678
689679<p>Application developers should be careful writing to on-device logs.
690680In Android, logs are a shared resource, and are available
@@ -724,9 +714,8 @@ credentials to the wrong application.</p>
724714<p>If credentials are to be used only by applications that you create, then you
725715can verify the application which accesses the <code><a
726716href="{@docRoot}reference/android/accounts/AccountManager.html">
727- AccountManager</a></code> using <code><a href="<code><a
728- href="{@docRoot}h/reference/android/content/pm/PackageManager.html#checkSignatur
729- es(java.lang.String,%20java.lang.String)">checkSignature()</a></code>.
717+ AccountManager</a></code> using <code><a
718+ href="{@docRoot}reference/android/content/pm/PackageManager.html#checkSignatures(java.lang.String,%20java.lang.String)">checkSignature()</a></code>.
730719Alternatively, if only one application will use the credential, you might use a
731720<code><a
732721href={@docRoot}reference/java/security/KeyStore.html">KeyStore</a></code> for
@@ -756,15 +745,15 @@ RSA provided in the <code><a
756745href="{@docRoot}reference/javax/crypto/Cipher.html">Cipher</a></code> class.</p>
757746
758747<p>Use a secure random number generator (
759- <a href="http://developer.android.com/ reference/java/security/SecureRandom.html">
748+ <a href="{@docRoot} reference/java/security/SecureRandom.html">
760749<code>SecureRandom</code></a>) to initialize any cryptographic keys (<a
761- href="http://developer.android.com/ reference/javax/crypto/KeyGenerator.html">
750+ href="{@docRoot} reference/javax/crypto/KeyGenerator.html">
762751<code>KeyGenerator</code></a>). Use of a key that is not generated with a secure random
763752number generator significantly weakens the strength of the algorithm, and may
764753allow offline attacks.</p>
765754
766755<p>If you need to store a key for repeated use, use a mechanism like <code><a
767- href={@docRoot}reference/java/security/KeyStore.html">KeyStore</a></code> that
756+ href=" {@docRoot}reference/java/security/KeyStore.html">KeyStore</a></code> that
768757provides a mechanism for long term storage and retrieval of cryptographic
769758keys.</p>
770759
0 commit comments