Merge "Validate RouteListingPreference GO_TO_APP component name" into udc-dev

services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java

@@ -285,8 +285,20 @@ class MediaRouter2ServiceImpl {
                         ? routeListingPreference.getLinkedItemComponentName()
                         : null;
         if (linkedItemLandingComponent != null) {
+            int callingUid = Binder.getCallingUid();
             MediaServerUtils.enforcePackageName(
-                    linkedItemLandingComponent.getPackageName(), Binder.getCallingUid());
+                    linkedItemLandingComponent.getPackageName(), callingUid);
+            if (!MediaServerUtils.isValidActivityComponentName(
+                    mContext,
+                    linkedItemLandingComponent,
+                    RouteListingPreference.ACTION_TRANSFER_MEDIA,
+                    Binder.getCallingUserHandle())) {
+                throw new IllegalArgumentException(
+                        "Unable to resolve "
+                                + linkedItemLandingComponent
+                                + " to a valid activity for "
+                                + RouteListingPreference.ACTION_TRANSFER_MEDIA);
+            }
         }
 
         final long token = Binder.clearCallingIdentity();

services/core/java/com/android/server/media/MediaServerUtils.java

@@ -16,9 +16,13 @@
 
 package com.android.server.media;
 
+import android.annotation.NonNull;
+import android.content.ComponentName;
 import android.content.Context;
+import android.content.Intent;
 import android.content.pm.PackageManager;
 import android.content.pm.PackageManagerInternal;
+import android.content.pm.ResolveInfo;
 import android.os.Binder;
 import android.os.Process;
 import android.os.UserHandle;
@@ -27,11 +31,27 @@ import android.text.TextUtils;
 import com.android.server.LocalServices;
 
 import java.io.PrintWriter;
+import java.util.List;
 
-/**
- * Util class for media server.
- */
-class MediaServerUtils {
+/** Util class for media server. */
+/* package */ class MediaServerUtils {
+
+    /**
+     * Returns whether the provided {@link ComponentName} and {@code action} resolve to a valid
+     * activity for the user defined by {@code userHandle}.
+     */
+    public static boolean isValidActivityComponentName(
+            @NonNull Context context,
+            @NonNull ComponentName componentName,
+            @NonNull String action,
+            @NonNull UserHandle userHandle) {
+        Intent intent = new Intent(action);
+        intent.setComponent(componentName);
+        List<ResolveInfo> resolveInfos =
+                context.getPackageManager()
+                        .queryIntentActivitiesAsUser(intent, /* flags= */ 0, userHandle);
+        return !resolveInfos.isEmpty();
+    }
 
     /**
      * Throws if the given {@code packageName} does not correspond to the given {@code uid}.