From 15fdb150a3ad5fbeebdcb2cbb8832073b49c64d3 Mon Sep 17 00:00:00 2001 From: Sunny Goyal Date: Wed, 14 Apr 2021 12:05:58 -0700 Subject: [PATCH] Preventing component spoofing during getShortcutConfigActivityIntent Bug: 160153281 Test: atest ShortcutManagerConfigActivityTest Change-Id: I93e63f10b0ec5066619ae44d49f7226fe42e949b --- .../android/server/pm/LauncherAppsService.java | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/services/core/java/com/android/server/pm/LauncherAppsService.java b/services/core/java/com/android/server/pm/LauncherAppsService.java index 91a66acf433df..dd80e167f0b30 100644 --- a/services/core/java/com/android/server/pm/LauncherAppsService.java +++ b/services/core/java/com/android/server/pm/LauncherAppsService.java @@ -636,9 +636,25 @@ public class LauncherAppsService extends SystemService { Objects.requireNonNull(component); // All right, create the sender. - Intent intent = new Intent(Intent.ACTION_CREATE_SHORTCUT).setComponent(component); + final int callingUid = injectBinderCallingUid(); final long identity = Binder.clearCallingIdentity(); try { + final PackageManagerInternal pmInt = + LocalServices.getService(PackageManagerInternal.class); + Intent packageIntent = new Intent(Intent.ACTION_CREATE_SHORTCUT) + .setPackage(component.getPackageName()); + List apps = pmInt.queryIntentActivities(packageIntent, + packageIntent.resolveTypeIfNeeded(mContext.getContentResolver()), + PackageManager.MATCH_DIRECT_BOOT_AWARE + | PackageManager.MATCH_DIRECT_BOOT_UNAWARE, + callingUid, user.getIdentifier()); + // ensure that the component is present in the list + if (!apps.stream().anyMatch( + ri -> component.getClassName().equals(ri.activityInfo.name))) { + return null; + } + + Intent intent = new Intent(Intent.ACTION_CREATE_SHORTCUT).setComponent(component); final PendingIntent pi = PendingIntent.getActivityAsUser( mContext, 0, intent, PendingIntent.FLAG_ONE_SHOT | PendingIntent.FLAG_IMMUTABLE | PendingIntent.FLAG_CANCEL_CURRENT,