Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[RESTRICT AUTOMERGE] Allow activity to be reparent while allowTaskReparenting is applied

Browse Source 
Any malicious application could hijack tasks by
android:allowTaskReparenting. This vulnerability can perform UI
spoofing or spying on user’s activities.

This CL only allows activities to be reparent while
android:allowTaskReparenting is applied and the affinity of activity
is same with the target task.

Bug: 240663194
Test: atest IntentTests
Change-Id: I73abb9ec05af95bc14f887ae825a9ada9600f771
This commit is contained in:
Jeff Chang
2022-09-14 16:10:04 +08:00
parent f8f07e22f1
commit 7da08c6bd3
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
services/core/java/com/android/server/wm/ResetTargetTaskHelper.java
View File

@@ -148,15 +148,16 @@ class ResetTargetTaskHelper {
return false; return false;
} else { } else {
mResultActivities.add(r);
if (r.resultTo != null) { if (r.resultTo != null) {
// If this activity is sending a reply to a previous activity, we can't do // If this activity is sending a reply to a previous activity, we can't do
// anything with it now until we reach the start of the reply chain. // anything with it now until we reach the start of the reply chain.
// NOTE: that we are assuming the result is always to the previous activity, // NOTE: that we are assuming the result is always to the previous activity,
// which is almost always the case but we really shouldn't count on. // which is almost always the case but we really shouldn't count on.
mResultActivities.add(r);
return false; return false;
} else if (mTargetTaskFound && allowTaskReparenting && mTargetTask.affinity != null } else if (mTargetTaskFound && allowTaskReparenting && mTargetTask.affinity != null
&& mTargetTask.affinity.equals(r.taskAffinity)) { && mTargetTask.affinity.equals(r.taskAffinity)) {
mResultActivities.add(r);
// This activity has an affinity for our task. Either remove it if we are // This activity has an affinity for our task. Either remove it if we are
// clearing or move it over to our task. Note that we currently punt on the case // clearing or move it over to our task. Note that we currently punt on the case
// where we are resetting a task that is not at the top but who has activities // where we are resetting a task that is not at the top but who has activities