Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Protect and prevent app's activity token

Browse Source 
Protect and prevent app's activity token passed to an untrusted app
process. And refine the starting PendingIntent flow in the SaveUi.

Fixes: 138430575
Fixes: 138431151
Test: atest CtsAutoFillServiceTestCases
Change-Id: I809ab30417959591b396dce90605f051d35611c1
This commit is contained in:
TYM Tsai
2019-08-01 20:19:18 +08:00
parent 1639760252
commit 7a188ae8ba
3 changed files with 45 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
services/autofill/java/com/android/server/autofill/Session.java
View File

@@ -887,7 +887,7 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
mMetricsLogger.write(log);
if (intentSender != null) {
if (sDebug) Slog.d(TAG, "Starting intent sender on save()");
startIntentSender(intentSender);
startIntentSenderAndFinishSession(intentSender);
}
// Nothing left to do...
@@ -1101,24 +1101,32 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
// AutoFillUiCallback
@Override
public void startIntentSender(IntentSender intentSender) {
public void startIntentSenderAndFinishSession(IntentSender intentSender) {
startIntentSender(intentSender, null);
}
// AutoFillUiCallback
@Override
public void startIntentSender(IntentSender intentSender, Intent intent) {
synchronized (mLock) {
if (mDestroyed) {
Slog.w(TAG, "Call to Session#startIntentSender() rejected - session: "
+ id + " destroyed");
return;
}
removeSelfLocked();
if (intent == null) {
removeSelfLocked();
}
}
mHandler.sendMessage(obtainMessage(
Session::doStartIntentSender,
this, intentSender));
this, intentSender, intent));
}
private void doStartIntentSender(IntentSender intentSender) {
private void doStartIntentSender(IntentSender intentSender, Intent intent) {
try {
synchronized (mLock) {
mClient.startIntentSender(intentSender, null);
mClient.startIntentSender(intentSender, intent);
}
} catch (RemoteException e) {
Slog.e(TAG, "Error launching auth intent", e);
@@ -1863,7 +1871,7 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
mHandler.sendMessage(obtainMessage(Session::logSaveShown, this));
final IAutoFillManagerClient client = getClient();
mPendingSaveUi = new PendingUi(mActivityToken, id, client);
mPendingSaveUi = new PendingUi(new Binder(), id, client);
final CharSequence serviceLabel;
final Drawable serviceIcon;

13
services/autofill/java/com/android/server/autofill/ui/AutoFillUI.java
View File

@@ -22,6 +22,7 @@ import android.annotation.NonNull;
import android.annotation.Nullable;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.IntentSender;
import android.graphics.drawable.Drawable;
import android.metrics.LogMaker;
@@ -82,7 +83,8 @@ public final class AutoFillUI {
void requestShowFillUi(AutofillId id, int width, int height,
IAutofillWindowPresenter presenter);
void requestHideFillUi(AutofillId id);
void startIntentSender(IntentSender intentSender);
void startIntentSenderAndFinishSession(IntentSender intentSender);
void startIntentSender(IntentSender intentSender, Intent intent);
void dispatchUnhandledKey(AutofillId id, KeyEvent keyEvent);
}
@@ -253,7 +255,7 @@ public final class AutoFillUI {
@Override
public void startIntentSender(IntentSender intentSender) {
if (mCallback != null) {
mCallback.startIntentSender(intentSender);
mCallback.startIntentSenderAndFinishSession(intentSender);
}
}
@@ -338,6 +340,13 @@ public final class AutoFillUI {
}
mMetricsLogger.write(log);
}
@Override
public void startIntentSender(IntentSender intentSender, Intent intent) {
if (mCallback != null) {
mCallback.startIntentSender(intentSender, intent);
}
}
}, mUiModeMgr.isNightMode(), isUpdate, compatMode);
});
}

37
services/autofill/java/com/android/server/autofill/ui/SaveUi.java
View File

@@ -32,7 +32,6 @@ import android.graphics.drawable.Drawable;
import android.metrics.LogMaker;
import android.os.Handler;
import android.os.IBinder;
import android.os.RemoteException;
import android.service.autofill.BatchUpdates;
import android.service.autofill.CustomDescription;
import android.service.autofill.InternalOnClickAction;
@@ -83,6 +82,7 @@ final class SaveUi {
void onSave();
void onCancel(IntentSender listener);
void onDestroy();
void startIntentSender(IntentSender intentSender, Intent intent);
}
/**
@@ -129,6 +129,15 @@ final class SaveUi {
mDone = true;
mRealListener.onDestroy();
}
@Override
public void startIntentSender(IntentSender intentSender, Intent intent) {
if (sDebug) Slog.d(TAG, "OneTimeListener.startIntentSender(): " + mDone);
if (mDone) {
return;
}
mRealListener.startIntentSender(intentSender, intent);
}
}
private final Handler mHandler = UiThread.getHandler();
@@ -168,8 +177,8 @@ final class SaveUi {
context = new ContextThemeWrapper(context, mThemeId) {
@Override
public void startActivity(Intent intent) {
intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
super.startActivity(intent);
PendingIntent p = PendingIntent.getActivity(this, 0, intent, 0);
mListener.startIntentSender(p.getIntentSender(), intent);
}
};
final LayoutInflater inflater = LayoutInflater.from(context);
@@ -329,21 +338,13 @@ final class SaveUi {
if (sVerbose) Slog.v(TAG, "Intercepting custom description intent");
final IBinder token = mPendingUi.getToken();
intent.putExtra(AutofillManager.EXTRA_RESTORE_SESSION_TOKEN, token);
try {
mPendingUi.client.startIntentSender(pendingIntent.getIntentSender(),
intent);
mPendingUi.setState(PendingUi.STATE_PENDING);
if (sDebug) Slog.d(TAG, "hiding UI until restored with token " + token);
hide();
log.setType(MetricsEvent.TYPE_OPEN);
mMetricsLogger.write(log);
return true;
} catch (RemoteException e) {
Slog.w(TAG, "error triggering pending intent: " + intent);
log.setType(MetricsEvent.TYPE_FAILURE);
mMetricsLogger.write(log);
return false;
}
mListener.startIntentSender(pendingIntent.getIntentSender(), intent);
mPendingUi.setState(PendingUi.STATE_PENDING);
if (sDebug) Slog.d(TAG, "hiding UI until restored with token " + token);
hide();
log.setType(MetricsEvent.TYPE_OPEN);
mMetricsLogger.write(log);
return true;
};
try {