Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RESTRICT AUTOMERGE: Prevent shortcut info package name spoofing

Browse Source 
Test: cts-tradefed run cts -m CtsShortcutManagerTestCases -t android.content.pm.cts.shortcutmanager.ShortcutManagerFakingPublisherTest
Bug: 109824443
Change-Id: I80b2680d9c7e067f1a36fc8ad1aac1d315022a71
This commit is contained in:
Makoto Onuki
2018-06-12 13:01:42 -07:00
committed by Atanas Kirilov
parent 390a015431
commit 2f7d50058a
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
services/core/java/com/android/server/pm/ShortcutService.java
View File

@@ -124,6 +124,7 @@ import java.nio.charset.StandardCharsets;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Collections; import java.util.Collections;
import java.util.List; import java.util.List;
import java.util.Objects;
import java.util.concurrent.atomic.AtomicBoolean; import java.util.concurrent.atomic.AtomicBoolean;
import java.util.function.Consumer; import java.util.function.Consumer;
import java.util.function.Predicate; import java.util.function.Predicate;
@@ -1514,6 +1515,24 @@ public class ShortcutService extends IShortcutService.Stub {
throw new SecurityException("Calling package name mismatch"); throw new SecurityException("Calling package name mismatch");
} }
private void verifyShortcutInfoPackage(String callerPackage, ShortcutInfo si) {
if (si == null) {
return;
}
if (!Objects.equals(callerPackage, si.getPackage())) {
android.util.EventLog.writeEvent(0x534e4554, "109824443", -1, "");
throw new SecurityException("Shortcut package name mismatch");
}
}
private void verifyShortcutInfoPackages(
String callerPackage, List<ShortcutInfo> list) {
final int size = list.size();
for (int i = 0; i < size; i++) {
verifyShortcutInfoPackage(callerPackage, list.get(i));
}
}
// Overridden in unit tests to execute r synchronously. // Overridden in unit tests to execute r synchronously.
void injectPostToHandler(Runnable r) { void injectPostToHandler(Runnable r) {
mHandler.post(r); mHandler.post(r);
@@ -1642,6 +1661,7 @@ public class ShortcutService extends IShortcutService.Stub {
verifyCaller(packageName, userId); verifyCaller(packageName, userId);
final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList(); final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();
verifyShortcutInfoPackages(packageName, newShortcuts);
final int size = newShortcuts.size(); final int size = newShortcuts.size();
synchronized (mLock) { synchronized (mLock) {
@@ -1693,6 +1713,7 @@ public class ShortcutService extends IShortcutService.Stub {
verifyCaller(packageName, userId); verifyCaller(packageName, userId);
final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList(); final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();
verifyShortcutInfoPackages(packageName, newShortcuts);
final int size = newShortcuts.size(); final int size = newShortcuts.size();
synchronized (mLock) { synchronized (mLock) {
@@ -1773,6 +1794,7 @@ public class ShortcutService extends IShortcutService.Stub {
verifyCaller(packageName, userId); verifyCaller(packageName, userId);
final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList(); final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();
verifyShortcutInfoPackages(packageName, newShortcuts);
final int size = newShortcuts.size(); final int size = newShortcuts.size();
synchronized (mLock) { synchronized (mLock) {