An app could skip Settings.Secure/Global and read the settings provider
straight through ContentResolver, getting the real accessibility, ADB and
developer-options state. Two routes, both now masked for the same keys the
Settings hooks cover:
- ContentResolver.call(content://settings/<table>, "GET_<table>", key):
the returned Bundle's "value" is rewritten to null / "0".
- ContentResolver.query on settings/secure and settings/global: the
cursor is replaced with a MatrixCursor with the value masked. The key is
read from the "name" column, or, when a caller projects only "value",
from the URI path or a single selection arg. Cursors that touch no
masked key are left as they were.
Verified on device with Veil Probe: call(), query() with name=?, and the
settings/global/<key> path form all report HIDDEN for accessibility,
adb_enabled and development_settings_enabled, and a scoped app still starts.
Co-Authored-By: agent <agent@bdeshi.space>
bdeshiandagent
cfed7989f2