From 4eccaf5e39010dcc57dedded3391e412d334ddcb Mon Sep 17 00:00:00 2001
From: RyanlwLin <ryanlwlin@google.com>
Date: Wed, 7 Aug 2019 16:18:18 +0800
Subject: [PATCH] Do not redispatch/inject motionevent to private virtual
 display

The virtaul display with private flag can't be access by other process.
To prevent AceesibilityService redispatches/injects motionevents on it,
We don't add it to valid displayList.

Bug: 138637403
Test: AccessibilityInputFilterTest
Test: AccessibilityGestureDectorTest
Change-Id: I7b60e4eee87b0812d3c882d0e45bbf2016190e6a
---
 .../AccessibilityInputFilter.java             |  2 +-
 .../AccessibilityManagerService.java          | 20 +++++++++++++++----
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/services/accessibility/java/com/android/server/accessibility/AccessibilityInputFilter.java b/services/accessibility/java/com/android/server/accessibility/AccessibilityInputFilter.java
index 18b6f90f921f2..c733d3bee6b63 100644
--- a/services/accessibility/java/com/android/server/accessibility/AccessibilityInputFilter.java
+++ b/services/accessibility/java/com/android/server/accessibility/AccessibilityInputFilter.java
@@ -29,8 +29,8 @@ import android.view.KeyEvent;
 import android.view.MotionEvent;
 import android.view.accessibility.AccessibilityEvent;
 
-import com.android.server.accessibility.gestures.TouchExplorer;
 import com.android.server.LocalServices;
+import com.android.server.accessibility.gestures.TouchExplorer;
 import com.android.server.policy.WindowManagerPolicy;
 
 import java.util.ArrayList;
diff --git a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
index b5b3cd2fe5300..4e4258bc2061f 100644
--- a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
+++ b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
@@ -2535,10 +2535,9 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub
                     // to create event handler per display. The events should be handled by the
                     // display which is overlaid by it.
                     final Display display = displays[i];
-                    if (display.getType() == Display.TYPE_OVERLAY) {
-                        continue;
+                    if (isValidDisplay(display)) {
+                        mDisplaysList.add(display);
                     }
-                    mDisplaysList.add(display);
                 }
             }
         }
@@ -2546,7 +2545,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub
         @Override
         public void onDisplayAdded(int displayId) {
             final Display display = mDisplayManager.getDisplay(displayId);
-            if (display == null || display.getType() == Display.TYPE_OVERLAY) {
+            if (!isValidDisplay(display)) {
                 return;
             }
 
@@ -2597,6 +2596,19 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub
         public void onDisplayChanged(int displayId) {
             /* do nothing */
         }
+
+        private boolean isValidDisplay(@Nullable Display display) {
+            if (display == null || display.getType() == Display.TYPE_OVERLAY) {
+                return false;
+            }
+            // Private virtual displays are created by the ap and is not allowed to access by other
+            // aps. We assume we could ignore them.
+            if ((display.getType() == Display.TYPE_VIRTUAL
+                    && (display.getFlags() & Display.FLAG_PRIVATE) != 0)) {
+                return false;
+            }
+            return true;
+        }
     }
 
     /** Represents an {@link AccessibilityManager} */