From 6e8d0f67ad12a2819c0bd5f39f28e484aa3c92a2 Mon Sep 17 00:00:00 2001
From: Rhed Jao <rhedjao@google.com>
Date: Tue, 31 May 2022 19:40:57 +0800
Subject: [PATCH] Fix cross user package visibility leakage for
 hasSigningCertificate

- To fix cross user package visibility leakage for the API
  #hasSigningCertificate, this CL returns false if the target
  package does not install in the calling user.

Bug: 229684723
Test: atest CrossUserPackageVisibilityTests
Change-Id: Id82ed5d2d4678acf185ea3561787c0213d4c0224
---
 .../core/java/com/android/server/pm/ComputerEngine.java   | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/services/core/java/com/android/server/pm/ComputerEngine.java b/services/core/java/com/android/server/pm/ComputerEngine.java
index 5bdc9d821e7c4..b19ed167244ba 100644
--- a/services/core/java/com/android/server/pm/ComputerEngine.java
+++ b/services/core/java/com/android/server/pm/ComputerEngine.java
@@ -4453,13 +4453,11 @@ public class ComputerEngine implements Computer {
         if (p == null) {
             return false;
         }
-        final PackageStateInternal ps = getPackageStateInternal(p.getPackageName());
-        if (ps == null) {
-            return false;
-        }
         final int callingUid = Binder.getCallingUid();
         final int callingUserId = UserHandle.getUserId(callingUid);
-        if (shouldFilterApplication(ps, callingUid, callingUserId)) {
+        final PackageStateInternal ps = getPackageStateInternal(p.getPackageName());
+        if (ps == null
+                || shouldFilterApplicationIncludingUninstalled(ps, callingUid, callingUserId)) {
             return false;
         }
         switch (type) {