Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Prevend user spoofing in isRequestPinItemSupported" into sc-dev am: 11f6a1013f

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/15340830

Change-Id: I69254c87809e8c4540e8d6639bc29ddb1a125d4a
This commit is contained in:
TreeHugger Robot
2021-08-19 19:24:30 +00:00
committed by Automerger Merge Worker
parent f1eb5cc17a 11f6a1013f
commit 464d03f2ff
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
services/core/java/com/android/server/pm/ShortcutService.java
View File

@@ -1664,6 +1664,19 @@ public class ShortcutService extends IShortcutService.Stub {
mContext.enforceCallingPermission(permission, message); mContext.enforceCallingPermission(permission, message);
} }
private void verifyCallerUserId(@UserIdInt int userId) {
if (isCallerSystem()) {
return; // no check
}
final int callingUid = injectBinderCallingUid();
// Otherwise, make sure the arguments are valid.
if (UserHandle.getUserId(callingUid) != userId) {
throw new SecurityException("Invalid user-ID");
}
}
private void verifyCaller(@NonNull String packageName, @UserIdInt int userId) { private void verifyCaller(@NonNull String packageName, @UserIdInt int userId) {
Preconditions.checkStringNotEmpty(packageName, "packageName"); Preconditions.checkStringNotEmpty(packageName, "packageName");
@@ -2847,6 +2860,8 @@ public class ShortcutService extends IShortcutService.Stub {
@Override @Override
public boolean isRequestPinItemSupported(int callingUserId, int requestType) { public boolean isRequestPinItemSupported(int callingUserId, int requestType) {
verifyCallerUserId(callingUserId);
final long token = injectClearCallingIdentity(); final long token = injectClearCallingIdentity();
try { try {
return mShortcutRequestPinProcessor return mShortcutRequestPinProcessor