From 1efd9a0405c6b8d5ec0b00f327b588b9eb69ac0a Mon Sep 17 00:00:00 2001 From: Azhara Assanova Date: Wed, 11 Jan 2023 15:38:31 +0000 Subject: [PATCH] Make mutable PendingIntent explicit Starting from target SDK U, we will block creation of mutable PendingIntents with implicit Intents because attackers can mutate the Intent object within and launch altered behavior on behalf of victim apps. For more details on the vulnerability, see go/pendingintent-rca. From a quick analysis, we concluded that the PendingIntent here was only destined to the test app/to the app, so it was made explicit. Reviewers, please call out if this is not the case. Bug: 236704164 Bug: 229362273 Test: atest OverlayManagerPerfTest Test: atest CtsPackageInstallTestCases Test: atest NotificationManagerServiceTest Change-Id: I56cc8c1852caffadae424e08d7719f58779bab11 --- .../src/android/perftests/utils/TestPackageInstaller.java | 4 ++-- .../android/packageinstaller/wear/PackageInstallerImpl.java | 2 +- .../server/notification/NotificationManagerServiceTest.java | 6 ++++-- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/apct-tests/perftests/utils/src/android/perftests/utils/TestPackageInstaller.java b/apct-tests/perftests/utils/src/android/perftests/utils/TestPackageInstaller.java index 15a65ce29bd97..1397706c6fd8e 100644 --- a/apct-tests/perftests/utils/src/android/perftests/utils/TestPackageInstaller.java +++ b/apct-tests/perftests/utils/src/android/perftests/utils/TestPackageInstaller.java @@ -133,9 +133,9 @@ public class TestPackageInstaller { mContext.registerReceiver(this, filter, Context.RECEIVER_EXPORTED_UNAUDITED); - Intent intent = new Intent(action); + Intent intent = new Intent(action).setPackage(mContext.getPackageName()); PendingIntent pending = PendingIntent.getBroadcast(mContext, sessionId, intent, - PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_MUTABLE_UNAUDITED); + PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_MUTABLE); return pending.getIntentSender(); } diff --git a/packages/PackageInstaller/src/com/android/packageinstaller/wear/PackageInstallerImpl.java b/packages/PackageInstaller/src/com/android/packageinstaller/wear/PackageInstallerImpl.java index 8dd691d14092a..1e37f15f714d9 100644 --- a/packages/PackageInstaller/src/com/android/packageinstaller/wear/PackageInstallerImpl.java +++ b/packages/PackageInstaller/src/com/android/packageinstaller/wear/PackageInstallerImpl.java @@ -268,7 +268,7 @@ public class PackageInstallerImpl { Context.RECEIVER_EXPORTED); // Create a matching PendingIntent and use it to generate the IntentSender - Intent broadcastIntent = new Intent(action); + Intent broadcastIntent = new Intent(action).setPackage(mContext.getPackageName()); PendingIntent pendingIntent = PendingIntent.getBroadcast(mContext, packageName.hashCode(), broadcastIntent, PendingIntent.FLAG_ONE_SHOT | PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_MUTABLE); diff --git a/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java b/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java index d54d1fed1016d..5f8a2b5027efc 100755 --- a/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java +++ b/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java @@ -839,7 +839,8 @@ public class NotificationManagerServiceTest extends UiServiceTestCase { .setName("bubblebot") .build(); RemoteInput remoteInput = new RemoteInput.Builder("reply_key").setLabel("reply").build(); - PendingIntent inputIntent = PendingIntent.getActivity(mContext, 0, new Intent(), + PendingIntent inputIntent = PendingIntent.getActivity(mContext, 0, + new Intent().setPackage(mContext.getPackageName()), PendingIntent.FLAG_MUTABLE); Icon icon = Icon.createWithResource(mContext, android.R.drawable.sym_def_app_icon); Notification.Action replyAction = new Notification.Action.Builder(icon, "Reply", @@ -9227,7 +9228,8 @@ public class NotificationManagerServiceTest extends UiServiceTestCase { NotificationRecord r = generateNotificationRecord(mTestNotificationChannel); ArrayList extraAction = new ArrayList<>(); RemoteInput remoteInput = new RemoteInput.Builder("reply_key").setLabel("reply").build(); - PendingIntent inputIntent = PendingIntent.getActivity(mContext, 0, new Intent(), + PendingIntent inputIntent = PendingIntent.getActivity(mContext, 0, + new Intent().setPackage(mContext.getPackageName()), PendingIntent.FLAG_MUTABLE); Icon icon = Icon.createWithResource(mContext, android.R.drawable.sym_def_app_icon); Notification.Action replyAction = new Notification.Action.Builder(icon, "Reply",