From 3b8aa02ba51f26161519f6465515f619e663bbbf Mon Sep 17 00:00:00 2001
From: Vishnu Nair <vishnun@google.com>
Date: Fri, 24 Sep 2021 11:01:31 -0700
Subject: [PATCH] Drop input for toast and child surfaces

Toasts that do not have the trustedOverlay flag should not receive input.
These windows should not have any children, so force this hierarchy of
windows to drop all input by setting a flag on the toast window state
which will apply the DROP_INPUT flag on all windows with an input
channel. This is to prevent malicious apps from parenting surfaces with
input channels to the toast window.

Test: show toast and check if input feature flag DROP_INPUT id set via dumpsys
Bug: b/197296414

Change-Id: I316b76b685ca5030fd8aa91283555efcce4d6994
---
 .../java/com/android/server/wm/DisplayPolicy.java | 15 +++++++++++++++
 .../android/server/wm/WindowManagerService.java   |  1 +
 2 files changed, 16 insertions(+)

diff --git a/services/core/java/com/android/server/wm/DisplayPolicy.java b/services/core/java/com/android/server/wm/DisplayPolicy.java
index ccfb174e3d16c..e7b3bc932a583 100644
--- a/services/core/java/com/android/server/wm/DisplayPolicy.java
+++ b/services/core/java/com/android/server/wm/DisplayPolicy.java
@@ -122,6 +122,7 @@ import android.graphics.Insets;
 import android.graphics.PixelFormat;
 import android.graphics.Rect;
 import android.graphics.Region;
+import android.gui.DropInputMode;
 import android.hardware.power.Boost;
 import android.os.Handler;
 import android.os.IBinder;
@@ -958,6 +959,20 @@ public class DisplayPolicy {
         }
     }
 
+    /**
+     * Add additional policy if needed to ensure the window or its children should not receive any
+     * input.
+     */
+    public void setDropInputModePolicy(WindowState win, LayoutParams attrs) {
+        if (attrs.type == TYPE_TOAST
+                && (attrs.privateFlags & PRIVATE_FLAG_TRUSTED_OVERLAY) == 0) {
+            // Toasts should not receive input. These windows should not have any children, so
+            // force this hierarchy of windows to drop all input.
+            mService.mTransactionFactory.get()
+                    .setDropInputMode(win.getSurfaceControl(), DropInputMode.ALL).apply();
+        }
+    }
+
     /**
      * Check if a window can be added to the system.
      *
diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java
index 776a65db365f6..5947203e90216 100644
--- a/services/core/java/com/android/server/wm/WindowManagerService.java
+++ b/services/core/java/com/android/server/wm/WindowManagerService.java
@@ -1775,6 +1775,7 @@ public class WindowManagerService extends IWindowManager.Stub
 
             win.mToken.addWindow(win);
             displayPolicy.addWindowLw(win, attrs);
+            displayPolicy.setDropInputModePolicy(win, win.mAttrs);
             if (type == TYPE_APPLICATION_STARTING && activity != null) {
                 activity.attachStartingWindow(win);
                 ProtoLog.v(WM_DEBUG_STARTING_WINDOW, "addWindow: %s startingWindow=%s",