Android content providers that define a single permission for both read and write access prevent client applications from following the Principle of Least Privilege.

Why is this an issue?

The android:permission attribute sets a single permission that controls both read and write access to a content provider. This means any client application that needs read-only access must also be granted write access. Similarly, using the same permission string for both android:readPermission and android:writePermission has the same effect, making it impossible to grant fine-grained access.

What is the potential impact?

If a client application is compromised, the attacker gains both read and write access to the content provider, even if the application only needed read access. This increases the blast radius of any security incident, potentially allowing unauthorized data modification in addition to data theft.

How to fix it

Code examples

Use android:readPermission and android:writePermission with distinct permission strings to allow client applications to request only the level of access they need.

Noncompliant code example

<provider
  android:authorities="com.example.app.Provider"
  android:name="com.example.app.Provider"
  android:permission="com.example.app.PERMISSION"  <!-- Noncompliant -->
  android:exported="true"/>

Compliant solution

<provider
  android:authorities="com.example.app.Provider"
  android:name="com.example.app.Provider"
  android:readPermission="com.example.app.READ_PERMISSION"
  android:writePermission="com.example.app.WRITE_PERMISSION"
  android:exported="true"/>

Noncompliant code example

<provider
  android:authorities="com.example.app.Provider"
  android:name="com.example.app.Provider"
  android:readPermission="com.example.app.PERMISSION"  <!-- Noncompliant -->
  android:writePermission="com.example.app.PERMISSION" <!-- Noncompliant -->
  android:exported="true"/>

Compliant solution

<provider
  android:authorities="com.example.app.Provider"
  android:name="com.example.app.Provider"
  android:readPermission="com.example.app.READ_PERMISSION"
  android:writePermission="com.example.app.WRITE_PERMISSION"
  android:exported="true"/>

Resources

Documentation

Standards