From 830d54f2c75bee8bda4c3bdd3d62c9f2f58934b7 Mon Sep 17 00:00:00 2001
From: Beverly <beverlyt@google.com>
Date: Wed, 16 Aug 2017 14:46:54 -0400
Subject: [PATCH] USB debug dialog won't give permission if obscured.

Previously, the USB debugging dialog was suceptible
to tapjacking over tcp if a malicious party obscured
the USB debugging text to mask the id of the system
requesting permissions.

The fix prevents users from giving permissions if the
dialog being displayed is partially obscured.  Instead,
it will present a toast explaining to the user why they
cannot give permissions.

Test: manual
Bug: 62187985
Change-Id: I3bdcd1876cd6dbe8a728bbce74edb52ab79f3e4c
---
 packages/SystemUI/res/values/strings.xml      |  6 ++++
 .../systemui/usb/UsbDebuggingActivity.java    | 30 +++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/packages/SystemUI/res/values/strings.xml b/packages/SystemUI/res/values/strings.xml
index 9b2bffdda0409..340b2e167e7b7 100644
--- a/packages/SystemUI/res/values/strings.xml
+++ b/packages/SystemUI/res/values/strings.xml
@@ -2051,4 +2051,10 @@
     <!-- Prompt to turn off data usage [CHAR LIMIT=NONE] -->
     <string name="data_usage_disable_mobile" msgid="8656552431969276305">Turn off mobile data?</string>
 
+    <!-- Warning shown when user input has been blocked due to another app overlaying screen
+     content. Since we don't know what the app is showing on top of the input target, we
+     can't verify user consent. [CHAR LIMIT=NONE] -->
+    <string name="touch_filtered_warning">Because an app is obscuring a permission request, Settings
+        can’t verify your response.</string>
+
 </resources>
diff --git a/packages/SystemUI/src/com/android/systemui/usb/UsbDebuggingActivity.java b/packages/SystemUI/src/com/android/systemui/usb/UsbDebuggingActivity.java
index f5447a293503f..70efe5c5cba23 100644
--- a/packages/SystemUI/src/com/android/systemui/usb/UsbDebuggingActivity.java
+++ b/packages/SystemUI/src/com/android/systemui/usb/UsbDebuggingActivity.java
@@ -31,8 +31,12 @@ import android.os.ServiceManager;
 import android.os.SystemProperties;
 import android.util.Log;
 import android.view.LayoutInflater;
+import android.view.MotionEvent;
 import android.view.View;
+import android.view.Window;
+import android.view.WindowManager;
 import android.widget.CheckBox;
+import android.widget.Toast;
 
 import com.android.internal.app.AlertActivity;
 import com.android.internal.app.AlertController;
@@ -48,6 +52,9 @@ public class UsbDebuggingActivity extends AlertActivity
 
     @Override
     public void onCreate(Bundle icicle) {
+        Window window = getWindow();
+        window.setType(WindowManager.LayoutParams.TYPE_SYSTEM_DIALOG);
+
         super.onCreate(icicle);
 
         if (SystemProperties.getInt("service.adb.tcp.port", 0) == 0) {
@@ -79,6 +86,29 @@ public class UsbDebuggingActivity extends AlertActivity
         ap.mView = checkbox;
 
         setupAlert();
+
+        // adding touch listener on affirmative button - checks if window is obscured
+        // if obscured, do not let user give permissions (could be tapjacking involved)
+        final View.OnTouchListener filterTouchListener = (View v, MotionEvent event) -> {
+            // Filter obscured touches by consuming them.
+            if (((event.getFlags() & MotionEvent.FLAG_WINDOW_IS_OBSCURED) != 0)
+                    || ((event.getFlags() & MotionEvent.FLAG_WINDOW_IS_PARTIALLY_OBSCURED) != 0)) {
+                if (event.getAction() == MotionEvent.ACTION_UP) {
+                    Toast.makeText(v.getContext(),
+                            R.string.touch_filtered_warning,
+                            Toast.LENGTH_SHORT).show();
+                }
+                return true;
+            }
+            return false;
+        };
+        mAlert.getButton(BUTTON_POSITIVE).setOnTouchListener(filterTouchListener);
+
+    }
+
+    @Override
+    public void onWindowAttributesChanged(WindowManager.LayoutParams params) {
+        super.onWindowAttributesChanged(params);
     }
 
     private class UsbDisconnectedReceiver extends BroadcastReceiver {