From a01692d19b2d3bd9ece8506f14308196e7060622 Mon Sep 17 00:00:00 2001 From: Azhara Assanova Date: Wed, 11 Jan 2023 14:29:53 +0000 Subject: [PATCH] Add a no-op flag to a mutable implicit PendingIntent Starting from target SDK U, we will block creation of mutable PendingIntents with implicit Intents because attackers can mutate the Intent object within and launch altered behavior on behalf of victim apps. For more details on the vulnerability, see go/pendingintent-rca. From a quick analysis, we concluded that the intent inside the PendingIntent is only mutated inside startIntentSenderWithRestore() which makes it possible to delay its creation and make it immutable. However, this introduced test failures in SimpleSaveUiActivityTest. To preserve the current behaviour, we decided to add a no-op flag FLAG_ALLOW_UNSAFE_IMPLICIT_INTENT to the mutable implicit PendingIntent. This flag is introduced in ag/21018466. Bug: 236704164 Bug: 229362273 Test: atest CtsAutoFillServiceTestCases Change-Id: Ia4e883de3c1df23ae645c8477b7010bd8086e00b --- .../java/com/android/server/autofill/ui/SaveUi.java | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/services/autofill/java/com/android/server/autofill/ui/SaveUi.java b/services/autofill/java/com/android/server/autofill/ui/SaveUi.java index 7db27acf1afa8..b68adab20cd94 100644 --- a/services/autofill/java/com/android/server/autofill/ui/SaveUi.java +++ b/services/autofill/java/com/android/server/autofill/ui/SaveUi.java @@ -199,8 +199,10 @@ final class SaveUi { intent.putExtra(AutofillManager.EXTRA_RESTORE_CROSS_ACTIVITY, true); PendingIntent p = PendingIntent.getActivityAsUser(this, /* requestCode= */ 0, - intent, PendingIntent.FLAG_MUTABLE, /* options= */ null, - UserHandle.CURRENT); + intent, + PendingIntent.FLAG_MUTABLE + | PendingIntent.FLAG_ALLOW_UNSAFE_IMPLICIT_INTENT, + /* options= */ null, UserHandle.CURRENT); if (sDebug) { Slog.d(TAG, "startActivity add save UI restored with intent=" + intent); }