Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix security hole in Google backup transport registration" into froyo

Browse Source
This commit is contained in:
Christopher Tate
2010-04-21 18:10:20 -07:00
committed by Android (Google) Code Review
parent 23c0b2eb5a a32504fce8
commit 36fa47139d
1 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
services/java/com/android/server/BackupManagerService.java
View File

@@ -479,10 +479,25 @@ class BackupManagerService extends IBackupManager.Stub {
// Attach to the Google backup transport. When this comes up, it will set // Attach to the Google backup transport. When this comes up, it will set
// itself as the current transport because we explicitly reset mCurrentTransport // itself as the current transport because we explicitly reset mCurrentTransport
// to null. // to null.
Intent intent = new Intent().setComponent(new ComponentName( ComponentName transportComponent = new ComponentName("com.google.android.backup",
"com.google.android.backup", "com.google.android.backup.BackupTransportService");
"com.google.android.backup.BackupTransportService")); try {
context.bindService(intent, mGoogleConnection, Context.BIND_AUTO_CREATE); // If there's something out there that is supposed to be the Google
// backup transport, make sure it's legitimately part of the OS build
// and not an app lying about its package name.
ApplicationInfo info = mPackageManager.getApplicationInfo(
transportComponent.getPackageName(), 0);
if ((info.flags & ApplicationInfo.FLAG_SYSTEM) != 0) {
if (DEBUG) Slog.v(TAG, "Binding to Google transport");
Intent intent = new Intent().setComponent(transportComponent);
context.bindService(intent, mGoogleConnection, Context.BIND_AUTO_CREATE);
} else {
Slog.w(TAG, "Possible Google transport spoof: ignoring " + info);
}
} catch (PackageManager.NameNotFoundException nnf) {
// No such package? No binding.
if (DEBUG) Slog.v(TAG, "Google transport not present");
}
// Now that we know about valid backup participants, parse any // Now that we know about valid backup participants, parse any
// leftover journal files into the pending backup set // leftover journal files into the pending backup set