Linus Rath 49c5d05c30 fix: keep every provider write of device sync inside its own account #34 ...

The native side ANDs the account's scope onto each selection the engine
sends, as `(where) AND (scope)`. A selection such as `1) OR (1` closed
the scope's parenthesis itself: on the calendar tables, where
CalendarProvider adds no account filter of its own, an update or delete
built that way would have reached the events, attendees and calendars
of other accounts, e.g. the user's Google calendar. The engine only
sends constant selections, so this guards against bugs rather than
anything an outside app could send, which is what the scope is for.

- Selections and sort orders must balance their parentheses outside
  quoted literals, and may not end the statement, carry comments or
  query other tables (`SELECT`, `UNION`, `ATTACH`, `PRAGMA`).
- An update of a data row by id that writes `data1` without restating
  the mimetype has the row's mimetype looked up: on a membership row
  `data1` names a group, which must be the account's, as on insert.
  Such writes by selection are refused.
- `data14`, a photo row's file id, is never written: another account's
  file id would have let `readPhoto` read that account's photo.

Checked: 58 JVM tests (`gradlew :app:testDebugUnitTest`, three new), the
debug build, and every selection the engine and planners send against
the new rules.

2026-09-27 06:12:08 +02:00

..

src

fix: keep every provider write of device sync inside its own account #34

2026-09-27 06:12:08 +02:00

build.gradle

feat: register a bulwark account with android's contacts and calendar sync #34

2026-09-27 01:53:40 +02:00

debug.keystore

chore: add Android release CI and sync local work

2026-04-26 04:12:08 +02:00

google-services.json

chore: add Android release CI and sync local work

2026-04-26 04:12:08 +02:00

proguard-rules.pro

fix: shrink the android release with r8

2026-09-24 21:13:42 +02:00