From 381e5b4d6613910b0786abd624d075989a626d13 Mon Sep 17 00:00:00 2001 From: Miranda Kephart Date: Thu, 25 Jun 2020 09:42:21 -0400 Subject: [PATCH] Send PendingIntent for screenshot smart actions Currently we extract the intent and send that directly, which means it is sent with SysUI's permissions (which is a security vulnerability). This change switches to sending the PendingIntent (with the creator's permissions) instead. Bug: 159822190 Fix: 159822190 Test: manual (ensured that the smart actions still work) Change-Id: Ia567272382021d4324974fb7d8c2c01b7e556846 --- .../android/systemui/screenshot/GlobalScreenshot.java | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/packages/SystemUI/src/com/android/systemui/screenshot/GlobalScreenshot.java b/packages/SystemUI/src/com/android/systemui/screenshot/GlobalScreenshot.java index 9bbc4ddcc62cd..8e878ddc6da1a 100644 --- a/packages/SystemUI/src/com/android/systemui/screenshot/GlobalScreenshot.java +++ b/packages/SystemUI/src/com/android/systemui/screenshot/GlobalScreenshot.java @@ -58,7 +58,6 @@ import android.os.Looper; import android.os.Message; import android.os.PowerManager; import android.os.RemoteException; -import android.os.UserHandle; import android.provider.Settings; import android.util.DisplayMetrics; import android.util.Log; @@ -1179,11 +1178,15 @@ public class GlobalScreenshot implements ViewTreeObserver.OnComputeInternalInset @Override public void onReceive(Context context, Intent intent) { PendingIntent pendingIntent = intent.getParcelableExtra(EXTRA_ACTION_INTENT); - Intent actionIntent = pendingIntent.getIntent(); String actionType = intent.getStringExtra(EXTRA_ACTION_TYPE); - Slog.d(TAG, "Executing smart action [" + actionType + "]:" + actionIntent); + Slog.d(TAG, "Executing smart action [" + actionType + "]:" + pendingIntent.getIntent()); ActivityOptions opts = ActivityOptions.makeBasic(); - context.startActivityAsUser(actionIntent, opts.toBundle(), UserHandle.CURRENT); + + try { + pendingIntent.send(context, 0, null, null, null, null, opts.toBundle()); + } catch (PendingIntent.CanceledException e) { + Log.e(TAG, "Pending intent canceled", e); + } ScreenshotSmartActions.notifyScreenshotAction( context, intent.getStringExtra(EXTRA_ID), actionType, true);