Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Validate package name passed to setApplicationRestrictions.

Browse Source 
This adds validation that the package name passed to
setApplicationRestrictions is in the correct format. This will avoid
an issue where a path could be entered resulting in a file being
written to an unexpected place.

Bug: 239701237
Test: atest ApplicationRestrictionsTest
Change-Id: I1ab2b7228470f10ec26fe3a608ae540cfc9e9a96
This commit is contained in:
Oli Lan
2022-08-19 17:08:13 +01:00
parent f3806167a1
commit 31a582490d
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
services/core/java/com/android/server/pm/UserManagerService.java
View File

@@ -54,6 +54,7 @@ import android.content.pm.ShortcutServiceInternal;
import android.content.pm.UserInfo; import android.content.pm.UserInfo;
import android.content.pm.UserInfo.UserInfoFlag; import android.content.pm.UserInfo.UserInfoFlag;
import android.content.pm.UserProperties; import android.content.pm.UserProperties;
import android.content.pm.parsing.FrameworkParsingPackageUtils;
import android.content.res.Configuration; import android.content.res.Configuration;
import android.content.res.Resources; import android.content.res.Resources;
import android.graphics.Bitmap; import android.graphics.Bitmap;
@@ -5368,6 +5369,11 @@ public class UserManagerService extends IUserManager.Stub {
public void setApplicationRestrictions(String packageName, Bundle restrictions, public void setApplicationRestrictions(String packageName, Bundle restrictions,
@UserIdInt int userId) { @UserIdInt int userId) {
checkSystemOrRoot("set application restrictions"); checkSystemOrRoot("set application restrictions");
String validationResult =
FrameworkParsingPackageUtils.validateName(packageName, false, false);
if (validationResult != null) {
throw new IllegalArgumentException("Invalid package name: " + validationResult);
}
if (restrictions != null) { if (restrictions != null) {
restrictions.setDefusable(true); restrictions.setDefusable(true);
} }