From 1d2da1c0053f51b933cd2d2338598678db701f84 Mon Sep 17 00:00:00 2001
From: Santiago Seifert <aquilescanta@google.com>
Date: Mon, 17 Apr 2023 09:36:27 +0000
Subject: [PATCH] Validate RouteListingPreference GO_TO_APP component name

Bug: 278510253
Test: atest MediaRouter2HostSideTest
Change-Id: I8456682cba3f48ba24015891637fa19e6101948b
---
 .../server/media/MediaRouter2ServiceImpl.java | 14 +++++++++-
 .../server/media/MediaServerUtils.java        | 28 ++++++++++++++++---
 2 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java b/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
index 2d3b97b768d38..926c5919d3d3c 100644
--- a/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
+++ b/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
@@ -285,8 +285,20 @@ class MediaRouter2ServiceImpl {
                         ? routeListingPreference.getLinkedItemComponentName()
                         : null;
         if (linkedItemLandingComponent != null) {
+            int callingUid = Binder.getCallingUid();
             MediaServerUtils.enforcePackageName(
-                    linkedItemLandingComponent.getPackageName(), Binder.getCallingUid());
+                    linkedItemLandingComponent.getPackageName(), callingUid);
+            if (!MediaServerUtils.isValidActivityComponentName(
+                    mContext,
+                    linkedItemLandingComponent,
+                    RouteListingPreference.ACTION_TRANSFER_MEDIA,
+                    Binder.getCallingUserHandle())) {
+                throw new IllegalArgumentException(
+                        "Unable to resolve "
+                                + linkedItemLandingComponent
+                                + " to a valid activity for "
+                                + RouteListingPreference.ACTION_TRANSFER_MEDIA);
+            }
         }
 
         final long token = Binder.clearCallingIdentity();
diff --git a/services/core/java/com/android/server/media/MediaServerUtils.java b/services/core/java/com/android/server/media/MediaServerUtils.java
index a4a99afd510de..60592feb867d1 100644
--- a/services/core/java/com/android/server/media/MediaServerUtils.java
+++ b/services/core/java/com/android/server/media/MediaServerUtils.java
@@ -16,9 +16,13 @@
 
 package com.android.server.media;
 
+import android.annotation.NonNull;
+import android.content.ComponentName;
 import android.content.Context;
+import android.content.Intent;
 import android.content.pm.PackageManager;
 import android.content.pm.PackageManagerInternal;
+import android.content.pm.ResolveInfo;
 import android.os.Binder;
 import android.os.Process;
 import android.os.UserHandle;
@@ -27,11 +31,27 @@ import android.text.TextUtils;
 import com.android.server.LocalServices;
 
 import java.io.PrintWriter;
+import java.util.List;
 
-/**
- * Util class for media server.
- */
-class MediaServerUtils {
+/** Util class for media server. */
+/* package */ class MediaServerUtils {
+
+    /**
+     * Returns whether the provided {@link ComponentName} and {@code action} resolve to a valid
+     * activity for the user defined by {@code userHandle}.
+     */
+    public static boolean isValidActivityComponentName(
+            @NonNull Context context,
+            @NonNull ComponentName componentName,
+            @NonNull String action,
+            @NonNull UserHandle userHandle) {
+        Intent intent = new Intent(action);
+        intent.setComponent(componentName);
+        List<ResolveInfo> resolveInfos =
+                context.getPackageManager()
+                        .queryIntentActivitiesAsUser(intent, /* flags= */ 0, userHandle);
+        return !resolveInfos.isEmpty();
+    }
 
     /**
      * Throws if the given {@code packageName} does not correspond to the given {@code uid}.