Download manager "my_downloads" returns all downloads, always [398006843]

Infeasible

Bug

NeedsInfo

Status Update

No update yet.

Description

je...@gmail.com

created issue #1

Feb 21, 2025 12:02AM

Code: Android 15 (but present on mainline)

Device: Clover C501

The Android "my_downloads" URI is meant to return all downloads owned by the calling app's UID, according to the uid field of the downloads database.

// The "my_downloads" view normally limits the caller to operating
// on downloads that they either directly own, or have been given
// indirect ownership of via OTHER_UID.

There's an exception to this, where if the caller has the ACCESS_ALL_DOWNLOADS permission, it returns all downloads, instead of "my" downloads; it skips adding the UID match clause in the query.

However, the implementation checks if caller OR SELF has ACCESS_ALL_DOWNLOADS permission. Self is com.android.providers.download, and it always has theACCESS_ALL_DOWNLOADS permission. This causes anything querying "my" downloads to get ALL downloads, not just their own.

Comments

vi...@google.com <vi...@google.com> #2Feb 21, 2025 08:02AM

Assigned to vi...@google.com.

Thank you for reporting this issue. For us to further investigate this issue, please provide the following additional information:

Which Android build are you using? (e.g. AP4A.241205.013.A1)

Can you confirm if this issue is reproducible on a Pixel/Nexus device?

Please provide a sample project or apk to reproduce the issue. Also mention the steps to be followed for reproducing the issue with the given sample project or apk.

Android bug report (to be captured after reproducing the issue)
For steps to capture a bug report, please refer:

https://developer.android.com/studio/debug/bug-report#bugreportdevice

Alternate method
Navigate to “Developer options”, ensure “USB debugging” is enabled, then enable “Bug report shortcut”. Capture bug report by holding the power button and selecting the “Take bug report” option.

Note: Please upload the bug report and screenshot to google drive and share the folder to android-bugreport@google.com, then share the link here.
Add comment

je...@gmail.com <je...@gmail.com> #3Feb 21, 2025 05:55PM

I already noted the Android version, read the description. I don't have a pixel device.

je...@gmail.com <je...@gmail.com> #4Feb 21, 2025 08:06PM

This bug is invalid. Please close.

vi...@google.com <vi...@google.com> #5Feb 24, 2025 11:01AM

Status: Won't Fix (Infeasible)

We are closing this issue based on above comment, Thanks

Issue 398006843

Description

Issue summary

Comments

vi...@google.com <vi...@google.com> #2Feb 21, 2025 08:02AM

je...@gmail.com <je...@gmail.com> #3Feb 21, 2025 05:55PM

je...@gmail.com <je...@gmail.com> #4Feb 21, 2025 08:06PM

vi...@google.com <vi...@google.com> #5Feb 24, 2025 11:01AM

Add comment

Issue metadata