From 0b998c2a0ee49e57601f0559fae4f46d528c1ef7 Mon Sep 17 00:00:00 2001
From: Jaewan Kim <jaewan@google.com>
Date: Fri, 1 Oct 2021 00:14:03 +0900
Subject: [PATCH] [DO NOT MERGE] Verify package name and UID for trusted app
 check

Bug: 179783181
Test: Run CTS
Change-Id: I19e52fef310762dc1d4193901cfc6c23370115b6
---
 .../server/media/MediaSessionService.java       | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/services/core/java/com/android/server/media/MediaSessionService.java b/services/core/java/com/android/server/media/MediaSessionService.java
index b477ea353c25f..29a5469367cdb 100644
--- a/services/core/java/com/android/server/media/MediaSessionService.java
+++ b/services/core/java/com/android/server/media/MediaSessionService.java
@@ -2128,6 +2128,23 @@ public class MediaSessionService extends SystemService implements Monitor {
                 // Enabled notification listener only works within the same user.
                 return false;
             }
+            // Verify whether package name and controller UID.
+            // It will indirectly check whether the caller has obtained the package name and UID
+            // via ControllerInfo or with the valid package name visibility.
+            try {
+                int actualControllerUid = mContext.getPackageManager().getPackageUidAsUser(
+                        controllerPackageName,
+                        UserHandle.getUserId(controllerUid));
+                if (controllerUid != actualControllerUid) {
+                    Log.w(TAG, "Failed to check enabled notification listener. Package name and"
+                            + " UID doesn't match");
+                    return false;
+                }
+            } catch (PackageManager.NameNotFoundException e) {
+                Log.w(TAG, "Failed to check enabled notification listener. Package name doesn't"
+                        + " exist");
+                return false;
+            }
 
             if (mNotificationManager.hasEnabledNotificationListener(controllerPackageName,
                     UserHandle.getUserHandleForUid(controllerUid))) {