Merge "Prevend user spoofing in isRequestPinItemSupported" into sc-dev am: 11f6a1013f am: 1170d1ca17 am: f89d674f35

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/15340830

Change-Id: I7b0d414af3965930c0f613b86224b2ee240d9fab

services/core/java/com/android/server/pm/ShortcutService.java

@@ -1664,6 +1664,19 @@ public class ShortcutService extends IShortcutService.Stub {
         mContext.enforceCallingPermission(permission, message);
     }
 
+    private void verifyCallerUserId(@UserIdInt int userId) {
+        if (isCallerSystem()) {
+            return; // no check
+        }
+
+        final int callingUid = injectBinderCallingUid();
+
+        // Otherwise, make sure the arguments are valid.
+        if (UserHandle.getUserId(callingUid) != userId) {
+            throw new SecurityException("Invalid user-ID");
+        }
+    }
+
     private void verifyCaller(@NonNull String packageName, @UserIdInt int userId) {
         Preconditions.checkStringNotEmpty(packageName, "packageName");
 
@@ -2847,6 +2860,8 @@ public class ShortcutService extends IShortcutService.Stub {
 
     @Override
     public boolean isRequestPinItemSupported(int callingUserId, int requestType) {
+        verifyCallerUserId(callingUserId);
+
         final long token = injectClearCallingIdentity();
         try {
             return mShortcutRequestPinProcessor