Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix a security issue in app widget service.

Browse Source 
Bug: 234013191
Test: atest RemoteViewsAdapterTest
Change-Id: Icd2eccb7a90124aca18a3dd463c3f79e3a595c20
This commit is contained in:
Pinyao Ting
2022-07-14 11:25:54 -07:00
parent dbdc3922fe
commit 263d7d0ba8
2 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/java/android/appwidget/AppWidgetManager.java
View File

@@ -1130,7 +1130,9 @@ public class AppWidgetManager {
* @param intent The intent of the service which will be providing the data to the * @param intent The intent of the service which will be providing the data to the
* RemoteViewsAdapter. * RemoteViewsAdapter.
* @param connection The callback interface to be notified when a connection is made or lost. * @param connection The callback interface to be notified when a connection is made or lost.
* @param flags Flags used for binding to the service * @param flags Flags used for binding to the service. Currently only
* {@link Context#BIND_AUTO_CREATE} and
* {@link Context#BIND_FOREGROUND_SERVICE_WHILE_AWAKE} are supported.
* *
* @see Context#getServiceDispatcher(ServiceConnection, Handler, int) * @see Context#getServiceDispatcher(ServiceConnection, Handler, int)
* @hide * @hide

5
services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
View File

@@ -1225,8 +1225,9 @@ class AppWidgetServiceImpl extends IAppWidgetService.Stub implements WidgetBacku
if (ActivityManager.getService().bindService( if (ActivityManager.getService().bindService(
caller, activtiyToken, intent, caller, activtiyToken, intent,
intent.resolveTypeIfNeeded(mContext.getContentResolver()), intent.resolveTypeIfNeeded(mContext.getContentResolver()),
connection, flags, mContext.getOpPackageName(), connection, flags & (Context.BIND_AUTO_CREATE
widget.provider.getUserId()) != 0) { | Context.BIND_FOREGROUND_SERVICE_WHILE_AWAKE),
mContext.getOpPackageName(), widget.provider.getUserId()) != 0) {
// Add it to the mapping of RemoteViewsService to appWidgetIds so that we // Add it to the mapping of RemoteViewsService to appWidgetIds so that we
// can determine when we can call back to the RemoteViewsService later to // can determine when we can call back to the RemoteViewsService later to