Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Revert "Verify URI permissions in MediaMetadata"" into tm-dev

Browse Source
This commit is contained in:
Miguel Aranda
2023-05-26 14:29:47 +00:00
committed by Android (Google) Code Review
parent cf672a9a5f f078924b02
commit 3f7b95fcfd
1 changed files with 9 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
services/core/java/com/android/server/media/MediaSessionRecord.java
View File

@@ -22,8 +22,6 @@ import android.annotation.Nullable;
import android.annotation.RequiresPermission; import android.annotation.RequiresPermission;
import android.app.PendingIntent; import android.app.PendingIntent;
import android.content.ComponentName; import android.content.ComponentName;
import android.content.ContentProvider;
import android.content.ContentResolver;
import android.content.Context; import android.content.Context;
import android.content.Intent; import android.content.Intent;
import android.content.pm.PackageManager; import android.content.pm.PackageManager;
@@ -65,9 +63,6 @@ import android.util.EventLog;
import android.util.Log; import android.util.Log;
import android.view.KeyEvent; import android.view.KeyEvent;
import com.android.server.LocalServices;
import com.android.server.uri.UriGrantsManagerInternal;
import java.io.PrintWriter; import java.io.PrintWriter;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Arrays; import java.util.Arrays;
@@ -83,10 +78,6 @@ import java.util.concurrent.CopyOnWriteArrayList;
// TODO(jaewan): Do not call service method directly -- introduce listener instead. // TODO(jaewan): Do not call service method directly -- introduce listener instead.
public class MediaSessionRecord implements IBinder.DeathRecipient, MediaSessionRecordImpl { public class MediaSessionRecord implements IBinder.DeathRecipient, MediaSessionRecordImpl {
private static final String TAG = "MediaSessionRecord"; private static final String TAG = "MediaSessionRecord";
private static final String[] ART_URIS = new String[] {
MediaMetadata.METADATA_KEY_ALBUM_ART_URI,
MediaMetadata.METADATA_KEY_ART_URI,
MediaMetadata.METADATA_KEY_DISPLAY_ICON_URI};
private static final boolean DEBUG = Log.isLoggable(TAG, Log.DEBUG); private static final boolean DEBUG = Log.isLoggable(TAG, Log.DEBUG);
/** /**
@@ -140,7 +131,6 @@ public class MediaSessionRecord implements IBinder.DeathRecipient, MediaSessionR
private final SessionStub mSession; private final SessionStub mSession;
private final SessionCb mSessionCb; private final SessionCb mSessionCb;
private final MediaSessionService mService; private final MediaSessionService mService;
private final UriGrantsManagerInternal mUgmInternal;
private final Context mContext; private final Context mContext;
private final boolean mVolumeAdjustmentForRemoteGroupSessions; private final boolean mVolumeAdjustmentForRemoteGroupSessions;
@@ -202,7 +192,6 @@ public class MediaSessionRecord implements IBinder.DeathRecipient, MediaSessionR
mAudioManager = (AudioManager) mContext.getSystemService(Context.AUDIO_SERVICE); mAudioManager = (AudioManager) mContext.getSystemService(Context.AUDIO_SERVICE);
mAudioAttrs = DEFAULT_ATTRIBUTES; mAudioAttrs = DEFAULT_ATTRIBUTES;
mPolicies = policies; mPolicies = policies;
mUgmInternal = LocalServices.getService(UriGrantsManagerInternal.class);
mVolumeAdjustmentForRemoteGroupSessions = mContext.getResources().getBoolean( mVolumeAdjustmentForRemoteGroupSessions = mContext.getResources().getBoolean(
com.android.internal.R.bool.config_volumeAdjustmentForRemoteGroupSessions); com.android.internal.R.bool.config_volumeAdjustmentForRemoteGroupSessions);
@@ -1029,43 +1018,19 @@ public class MediaSessionRecord implements IBinder.DeathRecipient, MediaSessionR
public void setMetadata(MediaMetadata metadata, long duration, String metadataDescription) public void setMetadata(MediaMetadata metadata, long duration, String metadataDescription)
throws RemoteException { throws RemoteException {
synchronized (mLock) { synchronized (mLock) {
mDuration = duration; MediaMetadata temp = metadata == null ? null : new MediaMetadata.Builder(metadata)
mMetadataDescription = metadataDescription; .build();
mMetadata = sanitizeMediaMetadata(metadata); // This is to guarantee that the underlying bundle is unparceled
}
mHandler.post(MessageHandler.MSG_UPDATE_METADATA);
}
private MediaMetadata sanitizeMediaMetadata(MediaMetadata metadata) {
if (metadata == null) {
return null;
}
MediaMetadata.Builder metadataBuilder = new MediaMetadata.Builder(metadata);
for (String key: ART_URIS) {
String uriString = metadata.getString(key);
if (TextUtils.isEmpty(uriString)) {
continue;
}
Uri uri = Uri.parse(uriString);
if (!ContentResolver.SCHEME_CONTENT.equals(uri.getScheme())) {
continue;
}
try {
mUgmInternal.checkGrantUriPermission(getUid(),
getPackageName(),
ContentProvider.getUriWithoutUserId(uri),
Intent.FLAG_GRANT_READ_URI_PERMISSION,
ContentProvider.getUserIdFromUri(uri, getUserId()));
} catch (SecurityException e) {
metadataBuilder.putString(key, null);
}
}
MediaMetadata sanitizedMetadata = metadataBuilder.build();
// sanitizedMetadata.size() guarantees that the underlying bundle is unparceled
// before we set it to prevent concurrent reads from throwing an // before we set it to prevent concurrent reads from throwing an
// exception // exception
sanitizedMetadata.size(); if (temp != null) {
return sanitizedMetadata; temp.size();
}
mMetadata = temp;
mDuration = duration;
mMetadataDescription = metadataDescription;
}
mHandler.post(MessageHandler.MSG_UPDATE_METADATA);
} }
@Override @Override