Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Backport Prevent shortcut info package name spoofing" into oc-dev am: c6dbcc137e am: dcc95b94f8

Browse Source 
am: ab3235ad5b

Change-Id: I1152d43ce2eec7cd5692d61df725bcd8b455aca3
This commit is contained in:
Atanas Kirilov
2018-06-27 18:35:46 -07:00
committed by android-build-merger
parent d63cfc9261 ab3235ad5b
commit 5fb8ac2010
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
services/core/java/com/android/server/pm/ShortcutService.java
View File

@@ -132,6 +132,7 @@ import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import java.util.Objects;
import java.util.concurrent.atomic.AtomicBoolean;
import java.util.function.Consumer;
import java.util.function.Predicate;
@@ -1573,6 +1574,24 @@ public class ShortcutService extends IShortcutService.Stub {
"Ephemeral apps can't use ShortcutManager");
}
private void verifyShortcutInfoPackage(String callerPackage, ShortcutInfo si) {
if (si == null) {
return;
}
if (!Objects.equals(callerPackage, si.getPackage())) {
android.util.EventLog.writeEvent(0x534e4554, "109824443", -1, "");
throw new SecurityException("Shortcut package name mismatch");
}
}
private void verifyShortcutInfoPackages(
String callerPackage, List<ShortcutInfo> list) {
final int size = list.size();
for (int i = 0; i < size; i++) {
verifyShortcutInfoPackage(callerPackage, list.get(i));
}
}
// Overridden in unit tests to execute r synchronously.
void injectPostToHandler(Runnable r) {
mHandler.post(r);
@@ -1720,6 +1739,7 @@ public class ShortcutService extends IShortcutService.Stub {
verifyCaller(packageName, userId);
final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();
verifyShortcutInfoPackages(packageName, newShortcuts);
final int size = newShortcuts.size();
final boolean unlimited = injectHasUnlimitedShortcutsApiCallsPermission(
@@ -1774,6 +1794,7 @@ public class ShortcutService extends IShortcutService.Stub {
verifyCaller(packageName, userId);
final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();
verifyShortcutInfoPackages(packageName, newShortcuts);
final int size = newShortcuts.size();
final boolean unlimited = injectHasUnlimitedShortcutsApiCallsPermission(
@@ -1859,6 +1880,7 @@ public class ShortcutService extends IShortcutService.Stub {
verifyCaller(packageName, userId);
final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();
verifyShortcutInfoPackages(packageName, newShortcuts);
final int size = newShortcuts.size();
final boolean unlimited = injectHasUnlimitedShortcutsApiCallsPermission(
@@ -1921,6 +1943,7 @@ public class ShortcutService extends IShortcutService.Stub {
Preconditions.checkNotNull(shortcut);
Preconditions.checkArgument(shortcut.isEnabled(), "Shortcut must be enabled");
verifyCaller(packageName, userId);
verifyShortcutInfoPackage(packageName, shortcut);
final Intent ret;
synchronized (mLock) {
@@ -1942,6 +1965,7 @@ public class ShortcutService extends IShortcutService.Stub {
private boolean requestPinItem(String packageName, int userId, ShortcutInfo shortcut,
AppWidgetProviderInfo appWidget, Bundle extras, IntentSender resultIntent) {
verifyCaller(packageName, userId);
verifyShortcutInfoPackage(packageName, shortcut);
final boolean ret;
synchronized (mLock) {