Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement visitUris for RemoteViews ViewGroupActionAdd.

Browse Source 
This is to prevent a vulnerability where notifications can show
resources belonging to other users, since the URI in the nested views
was not being checked.

Bug: 277740082
Test: atest RemoteViewsTest NotificationVisitUrisTest
Change-Id: I5c71f0bad0a6f6361eb5ceffe8d1e47e936d78f8
Merged-In: I5c71f0bad0a6f6361eb5ceffe8d1e47e936d78f8
This commit is contained in:
Ioana Alexandru
2023-05-12 15:41:09 +00:00
parent 71e7d4129d
commit 850fd984e5
2 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
core/java/android/widget/RemoteViews.java
View File

@@ -1672,6 +1672,11 @@ public class RemoteViews implements Parcelable, Filter {
public int getActionTag() { public int getActionTag() {
return VIEW_GROUP_ACTION_ADD_TAG; return VIEW_GROUP_ACTION_ADD_TAG;
} }
@Override
public final void visitUris(@NonNull Consumer<Uri> visitor) {
mNestedViews.visitUris(visitor);
}
} }
/** /**

24
core/tests/coretests/src/android/widget/RemoteViewsTest.java
View File

@@ -528,6 +528,30 @@ public class RemoteViewsTest {
verify(visitor, times(1)).accept(eq(icon4.getUri())); verify(visitor, times(1)).accept(eq(icon4.getUri()));
} }
@Test
public void visitUris_nestedViews() {
final RemoteViews outer = new RemoteViews(mPackage, R.layout.remote_views_test);
final RemoteViews inner = new RemoteViews(mPackage, 33);
final Uri imageUriI = Uri.parse("content://inner/image");
final Icon icon1 = Icon.createWithContentUri("content://inner/icon1");
final Icon icon2 = Icon.createWithContentUri("content://inner/icon2");
final Icon icon3 = Icon.createWithContentUri("content://inner/icon3");
final Icon icon4 = Icon.createWithContentUri("content://inner/icon4");
inner.setImageViewUri(R.id.image, imageUriI);
inner.setTextViewCompoundDrawables(R.id.text, icon1, icon2, icon3, icon4);
outer.addView(R.id.layout, inner);
Consumer<Uri> visitor = (Consumer<Uri>) spy(Consumer.class);
outer.visitUris(visitor);
verify(visitor, times(1)).accept(eq(imageUriI));
verify(visitor, times(1)).accept(eq(icon1.getUri()));
verify(visitor, times(1)).accept(eq(icon2.getUri()));
verify(visitor, times(1)).accept(eq(icon3.getUri()));
verify(visitor, times(1)).accept(eq(icon4.getUri()));
}
@Test @Test
public void visitUris_separateOrientation() { public void visitUris_separateOrientation() {
final RemoteViews landscape = new RemoteViews(mPackage, R.layout.remote_views_test); final RemoteViews landscape = new RemoteViews(mPackage, R.layout.remote_views_test);