Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix Security issue for Html.fromHtml without escape" into sc-dev

Browse Source
This commit is contained in:
Evan Chen
2021-09-07 20:45:33 +00:00
committed by Android (Google) Code Review
parent d90941ca06 8f005ffe4a
commit 535de78aac
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
packages/CompanionDeviceManager/src/com/android/companiondevicemanager/CompanionDeviceActivity.java
View File

@@ -93,9 +93,9 @@ public class CompanionDeviceActivity extends Activity {
final DeviceFilterPair selectedDevice = getService().mDevicesFound.get(0);
setTitle(Html.fromHtml(getString(
R.string.confirmation_title,
getCallingAppName(),
profileName,
selectedDevice.getDisplayName()), 0));
Html.escapeHtml(getCallingAppName()),
Html.escapeHtml(selectedDevice.getDisplayName())), 0));
mPairButton = findViewById(R.id.button_pair);
mPairButton.setOnClickListener(v -> onDeviceConfirmed(getService().mSelectedDevice));
getService().mSelectedDevice = selectedDevice;
@@ -108,8 +108,8 @@ public class CompanionDeviceActivity extends Activity {
mPairButton = findViewById(R.id.button_pair);
mPairButton.setVisibility(View.GONE);
setTitle(Html.fromHtml(getString(R.string.chooser_title,
profileName,
getCallingAppName()), 0));
Html.escapeHtml(profileName),
Html.escapeHtml(getCallingAppName())), 0));
mDeviceListView = findViewById(R.id.device_list);
mDevicesAdapter = new DevicesAdapter();
mDeviceListView.setAdapter(mDevicesAdapter);