Why is a content provider without permissions and with exported = true available for any application?

Question

Here is the test I came across to understand the proxy permissions for Android:

App ProviderApp manifest:

<provider
    android:authorities="com.mycompany.myProviderApp"
    android:name="com.mycompany.myProviderApp.ContentProviderForMyOtherApps"
    android:exported="true"/>

I also implemented a dummy ContentProvider( ContentProviderForMyOtherApps) base method queryreturning a string in ProviderApp:

public Cursor query(Uri uri, String[] projection, String selection, String[] selectionArgs, String sortOrder) {
    String[] cols = {"column1"};
    MatrixCursor cursor = new MatrixCursor(cols);
    MatrixCursor.RowBuilder builder = cursor.newRow();
    builder.add("HELLO!");
    return cursor;
}

---

ClientApp Application Code:

Cursor cursor = getContentResolver().query(Uri.parse("content://com.mycompany.myProviderApp"),null,null,null,null);
cursor.moveToFirst();
Log.d(TAG, cursor.getString(0)); // output: HELLO!

---

Good, so that everything works fine, ClientApp successfully gets access to the provider.

But my understanding of the documentation based on the excerpts below is that ClientApp had to deny access to the provider because:

• In the manifest, ProviderApp is not android:readPermissioninside provider(e.g., com.mycompany.myProviderApp.READ)
• ClientApp manifest has no match uses-permission(e.g. com.mycompany.myProviderApp.READ)

:

- , .

https://developer.android.com/guide/topics/providers/content-provider-basics.html#Permissions

:

use: true: . URI , , .

https://developer.android.com/guide/topics/manifest/provider-element.html

( , NO) ?

( ?)

Answer 1

. :

- , .

:

- , android:exported (true ; false ) android:grantUriPermissions ( ).

, . , .