Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Proper PendingIntent.queryIntentComponents implementation

Browse Source 
PendingIntent.queryIntentComponents currently does not take the pending
intent creator UID into account when performing component resolution.
This will return incorrect results, since explicit intents with
non-matching intent filter can only be resolved if the sender is the
same UID as the target component.

Bug: 238415222
Test: atest CtsContentTestCases:PackageManagerTest
Change-Id: Ib4e1c04c8de4e9bcee35d584dfb213954ec65449
This commit is contained in:
John Wu
2022-07-14 00:44:58 +00:00
parent 4760b7cda3
commit 6110caff69
4 changed files with 23 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
services/core/java/com/android/server/am/ActivityManagerService.java
View File

@@ -452,6 +452,7 @@ import java.util.LinkedList;
import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.Objects;
import java.util.Set;
import java.util.UUID;
import java.util.concurrent.CopyOnWriteArrayList;
@@ -5494,7 +5495,7 @@ public class ActivityManagerService extends IActivityManager.Stub
IIntentSender pendingResult, int matchFlags) {
enforceCallingPermission(Manifest.permission.GET_INTENT_SENDER_INTENT,
"queryIntentComponentsForIntentSender()");
Preconditions.checkNotNull(pendingResult);
Objects.requireNonNull(pendingResult);
final PendingIntentRecord res;
try {
res = (PendingIntentRecord) pendingResult;
@@ -5506,17 +5507,19 @@ public class ActivityManagerService extends IActivityManager.Stub
return null;
}
final int userId = res.key.userId;
final int uid = res.uid;
final String resolvedType = res.key.requestResolvedType;
switch (res.key.type) {
case ActivityManager.INTENT_SENDER_ACTIVITY:
return new ParceledListSlice<>(mContext.getPackageManager()
.queryIntentActivitiesAsUser(intent, matchFlags, userId));
return new ParceledListSlice<>(mPackageManagerInt.queryIntentActivities(
intent, resolvedType, matchFlags, uid, userId));
case ActivityManager.INTENT_SENDER_SERVICE:
case ActivityManager.INTENT_SENDER_FOREGROUND_SERVICE:
return new ParceledListSlice<>(mContext.getPackageManager()
.queryIntentServicesAsUser(intent, matchFlags, userId));
return new ParceledListSlice<>(mPackageManagerInt.queryIntentServices(
intent, matchFlags, uid, userId));
case ActivityManager.INTENT_SENDER_BROADCAST:
return new ParceledListSlice<>(mContext.getPackageManager()
.queryBroadcastReceiversAsUser(intent, matchFlags, userId));
return new ParceledListSlice<>(mPackageManagerInt.queryIntentReceivers(
intent, resolvedType, matchFlags, uid, userId, false));
default: // ActivityManager.INTENT_SENDER_ACTIVITY_RESULT
throw new IllegalStateException("Unsupported intent sender type: " + res.key.type);
}

2
services/core/java/com/android/server/pm/Computer.java
View File

@@ -112,6 +112,8 @@ public interface Computer extends PackageDataSnapshot {
@PackageManager.ResolveInfoFlagsBits long flags,
@PackageManagerInternal.PrivateResolveFlags long privateResolveFlags,
int filterCallingUid, int userId, boolean resolveForStart, boolean allowDynamicSplits);
@NonNull List<ResolveInfo> queryIntentActivitiesInternal(Intent intent, String resolvedType,
long flags, int filterCallingUid, int userId);
@NonNull List<ResolveInfo> queryIntentActivitiesInternal(Intent intent, String resolvedType,
long flags, int userId);
@NonNull List<ResolveInfo> queryIntentServicesInternal(Intent intent, String resolvedType,

9
services/core/java/com/android/server/pm/ComputerEngine.java
View File

@@ -599,6 +599,15 @@ public class ComputerEngine implements Computer {
resolveForStart, userId, intent);
}
@NonNull
@Override
public final List<ResolveInfo> queryIntentActivitiesInternal(Intent intent, String resolvedType,
@PackageManager.ResolveInfoFlagsBits long flags, int filterCallingUid, int userId) {
return queryIntentActivitiesInternal(
intent, resolvedType, flags, 0 /*privateResolveFlags*/, filterCallingUid,
userId, false /*resolveForStart*/, true /*allowDynamicSplits*/);
}
public final @NonNull List<ResolveInfo> queryIntentActivitiesInternal(Intent intent,
String resolvedType, @PackageManager.ResolveInfoFlagsBits long flags, int userId) {
return queryIntentActivitiesInternal(

3
services/core/java/com/android/server/pm/PackageManagerInternalBase.java
View File

@@ -308,7 +308,8 @@ abstract class PackageManagerInternalBase extends PackageManagerInternal {
public final List<ResolveInfo> queryIntentActivities(
Intent intent, String resolvedType, @PackageManager.ResolveInfoFlagsBits long flags,
int filterCallingUid, int userId) {
return snapshot().queryIntentActivitiesInternal(intent, resolvedType, flags, userId);
return snapshot().queryIntentActivitiesInternal(intent, resolvedType, flags,
filterCallingUid, userId);
}
@Override