Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Do not send new Intent to non-exported activity when navigateUpTo

Browse Source 
The new Intent was delivered to a non-exported activity while
#navigateUpTo was called from an Activity of a different uid.

Bug: 238605611
Test: atest StartActivityTests
Change-Id: I854dd825bfd9a2c08851980d480d1f3a177af6cf
Merged-In: I854dd825bfd9a2c08851980d480d1f3a177af6cf
This commit is contained in:
Louis Chang
2022-08-02 03:33:39 +00:00
parent 5a154b395a
commit 4c35569049
1 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
services/core/java/com/android/server/wm/Task.java
View File

@@ -5457,7 +5457,23 @@ class Task extends TaskFragment {
parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TASK || parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TASK ||
parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TOP || parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TOP ||
(destIntentFlags & Intent.FLAG_ACTIVITY_CLEAR_TOP) != 0) { (destIntentFlags & Intent.FLAG_ACTIVITY_CLEAR_TOP) != 0) {
parent.deliverNewIntentLocked(callingUid, destIntent, destGrants, srec.packageName); boolean abort;
try {
abort = !mTaskSupervisor.checkStartAnyActivityPermission(destIntent,
parent.info, null /* resultWho */, -1 /* requestCode */, srec.getPid(),
callingUid, srec.info.packageName, null /* callingFeatureId */,
false /* ignoreTargetSecurity */, false /* launchingInTask */, srec.app,
null /* resultRecord */, null /* resultRootTask */);
} catch (SecurityException e) {
abort = true;
}
if (abort) {
android.util.EventLog.writeEvent(0x534e4554, "238605611", callingUid, "");
foundParentInTask = false;
} else {
parent.deliverNewIntentLocked(callingUid, destIntent, destGrants,
srec.packageName);
}
} else { } else {
try { try {
ActivityInfo aInfo = AppGlobals.getPackageManager().getActivityInfo( ActivityInfo aInfo = AppGlobals.getPackageManager().getActivityInfo(