{"record":{"id":"95c0b94ce734e1ba","repo":"MuntashirAkon/AppManager","slug":"invalid-userid","errorCode":null,"errorMessage":"Invalid userId ","messagePattern":"Invalid userId ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/io/github/muntashirakon/AppManager/self/SelfPermissions.java","lineNumber":232,"sourceCode":"                    return false;\n                default:\n                    throw new IllegalStateException(\"Unknown AppOpsManager mode \" + opMode);\n            }\n        }\n        return checkSelfOrRemotePermission(Manifest.permission.WRITE_EXTERNAL_STORAGE, callingUid);\n    }\n\n    public static boolean checkCrossUserPermission(@UserIdInt int userId, boolean requireFullPermission) {\n        int callingUid = Users.getSelfOrRemoteUid();\n        return checkCrossUserPermission(userId, requireFullPermission, callingUid);\n    }\n\n    public static boolean checkCrossUserPermission(@UserIdInt int userId, boolean requireFullPermission, int callingUid) {\n        if (userId == UserHandleHidden.USER_NULL) {\n            userId = UserHandleHidden.myUserId();\n        }\n        if (userId < 0 && userId != UserHandleHidden.USER_ALL) {\n            throw new IllegalArgumentException(\"Invalid userId \" + userId);\n        }\n        if (isSystemOrRootOrShell(callingUid) || userId == UserHandleHidden.getUserId(callingUid)) {\n            return true;\n        }\n        if (requireFullPermission) {\n            return checkSelfOrRemotePermission(ManifestCompat.permission.INTERACT_ACROSS_USERS_FULL, callingUid);\n        }\n        return checkSelfOrRemotePermission(ManifestCompat.permission.INTERACT_ACROSS_USERS_FULL, callingUid)\n                || checkSelfOrRemotePermission(ManifestCompat.permission.INTERACT_ACROSS_USERS, callingUid);\n    }\n\n    public static boolean isShell() {\n        return Users.getSelfOrRemoteUid() == Ops.SHELL_UID;\n    }\n\n    public static boolean isSystem() {\n        return Users.getSelfOrRemoteUid() == Ops.SYSTEM_UID;\n    }","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/io/github/muntashirakon/AppManager/self/SelfPermissions.java#L214-L250","documentation":"checkCrossUserPermission validates the userId: USER_NULL is remapped to the current user, and only USER_ALL may otherwise be negative. Any other negative userId throws IllegalArgumentException(\"Invalid userId \" + userId), guarding IPC callers that pass garbage user handles.","triggerScenarios":"Calling checkCrossUserPermission (directly or via the 2-arg overload) with a userId that is negative and not UserHandleHidden.USER_ALL — typically an uninitialized userId field or a malformed value decoded from intent/bundle extras.","commonSituations":"Passing an uninitialized userId variable, decoding malformed IPC/intent data, mixing USER_NULL semantics across Android versions, calling from a context where myUserId() yields an unexpected value.","solutions":["Resolve or validate the userId before calling: use UserHandleHidden.myUserId() when unknown.","Only pass UserHandleHidden.USER_ALL for all-user queries; never other negative values.","Sanitize userId values from untrusted inputs (extras, IPC) before passing them in.","Catch IllegalArgumentException at the call site if the userId originates from user-provided data."],"exampleFix":"// before\nboolean allowed = SelfPermissions.checkCrossUserPermission(userId, false);\n// after\nif (userId == UserHandleHidden.USER_NULL) userId = UserHandleHidden.myUserId();\nif (userId < 0 && userId != UserHandleHidden.USER_ALL) {\n    throw new IllegalArgumentException(\"Cannot check cross-user permission for userId \" + userId);\n}\nboolean allowed = SelfPermissions.checkCrossUserPermission(userId, false);","handlingStrategy":"validation","validationCode":"if (userId == UserHandleHidden.USER_NULL) userId = UserHandleHidden.myUserId();\nif (userId < 0 && userId != UserHandleHidden.USER_ALL) {\n    throw new IllegalArgumentException(\"Refusing to call with userId \" + userId);\n}\nboolean allowed = SelfPermissions.checkCrossUserPermission(userId, requireFullPermission, callingUid);","typeGuard":"static boolean isValidUserId(int userId) {\n    return userId >= 0 || userId == UserHandleHidden.USER_ALL;\n}","tryCatchPattern":null,"preventionTips":["Never pass raw userId values from untrusted extras/IPC without validation.","Normalize USER_NULL to myUserId() before cross-user checks.","Use UserHandleHidden.USER_ALL explicitly for all-user queries.","Centralize userId sanitization in one utility so callers cannot skip it."],"tags":["android","userid","validation","ipc"],"backgroundTag":"invalid-argument-value","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}