tree f3cb8a7f0222bb36c0e34346b509219e5a0db4a4
parent a2a586a61a528a3bf16703148d072f253b32e638
author Winson <chiuwinson@google.com> 1603916744 -0700
committer Winson Chiu <chiuwinson@google.com> 1603918692 +0000

Remove updateIntentVerificationStatusAsUser from ResolverActivity

DO NOT CHERRY PICK ANYWHERE: Security issue

This API is meant to grant an app complete verification over the
domains it has declared, meaning it will always resolve the domains it
declares for web links.

This can allow an app to take over links that are unowned. Any time a
user selects "Always" when resolving an Intent in the diambiguation
dialog, this API would be called, and all subsequent resolutions of any
domain declared by the app selected would be automatically directed to
that app, with no prompt to the user.

From a quick search, it's possible that all usages of this API are
actually unintended and should be removed. Should be considered for
deprecation in the future.

Bug: 163358811

Test: none, this is not generally testable, see linked bug for context

Merged-In: Iff7f788a83af68c7fbb1c6b9a8be7b47136be2b6
Change-Id: Iff7f788a83af68c7fbb1c6b9a8be7b47136be2b6