(THIS CODING RULE OR GUIDELINE IS UNDER CONSTRUCTION)
If an app is using a granted permission to respond to a calling app then it must check that the calling app as has that permission as well. Otherwise, the responding app may be granting privileges to the calling app that it should not have. (This is sometimes called the "confused deputy" problem.)
...
Responding to a calling app without checking that it has the appropriate permissions can leak sensitive information.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
DRD14-J | High | Probable | Medium | P12 | L1 |
Automated Detection
It is not feasible to automatically detect whether an app's permissions need to be checked before responding to it.
Tool | Version | Checker | Description |
|---|
Bibliography
...