Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Preventing component spoofing during getShortcutConfigActivityIntent

Browse Source 
Bug: 160153281
Test: atest ShortcutManagerConfigActivityTest
Change-Id: I93e63f10b0ec5066619ae44d49f7226fe42e949b
This commit is contained in:
Sunny Goyal
2021-04-14 12:05:58 -07:00
parent f8f0b73025
commit 15fdb150a3
1 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
services/core/java/com/android/server/pm/LauncherAppsService.java
View File

@@ -636,9 +636,25 @@ public class LauncherAppsService extends SystemService {
Objects.requireNonNull(component);
// All right, create the sender.
Intent intent = new Intent(Intent.ACTION_CREATE_SHORTCUT).setComponent(component);
final int callingUid = injectBinderCallingUid();
final long identity = Binder.clearCallingIdentity();
try {
final PackageManagerInternal pmInt =
LocalServices.getService(PackageManagerInternal.class);
Intent packageIntent = new Intent(Intent.ACTION_CREATE_SHORTCUT)
.setPackage(component.getPackageName());
List<ResolveInfo> apps = pmInt.queryIntentActivities(packageIntent,
packageIntent.resolveTypeIfNeeded(mContext.getContentResolver()),
PackageManager.MATCH_DIRECT_BOOT_AWARE
| PackageManager.MATCH_DIRECT_BOOT_UNAWARE,
callingUid, user.getIdentifier());
// ensure that the component is present in the list
if (!apps.stream().anyMatch(
ri -> component.getClassName().equals(ri.activityInfo.name))) {
return null;
}
Intent intent = new Intent(Intent.ACTION_CREATE_SHORTCUT).setComponent(component);
final PendingIntent pi = PendingIntent.getActivityAsUser(
mContext, 0, intent, PendingIntent.FLAG_ONE_SHOT
| PendingIntent.FLAG_IMMUTABLE | PendingIntent.FLAG_CANCEL_CURRENT,