From 952cb89fdc66610cb7396ddab64e01df8928dae5 Mon Sep 17 00:00:00 2001 From: Guliz Seray Tuncay Date: Mon, 10 Aug 2020 20:09:48 +0000 Subject: [PATCH] Fix getRunningTasks info leak Using the getRunningTasks() API, apps can currently tell if there is an app in the foreground. This information can be utilized by attackers to launch phishing attacks (b/155337219). This issue can be prevented by not allowing the getRunningTasks() API to report the nexus launcher in its output. Bug: 155337219 Test: manual atest (WmTests:RunningTasksTest) Change-Id: Ib6c87815eb949f1481485ad8ba7b9b1dc6bc6323 --- services/core/java/com/android/server/wm/RunningTasks.java | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/wm/RunningTasks.java b/services/core/java/com/android/server/wm/RunningTasks.java index 6cf9432089b41..7b5b0ad870dda 100644 --- a/services/core/java/com/android/server/wm/RunningTasks.java +++ b/services/core/java/com/android/server/wm/RunningTasks.java @@ -99,9 +99,8 @@ class RunningTasks { // the task's profile return; } - if (!mAllowed && !task.isActivityTypeHome()) { - // Skip if the caller isn't allowed to fetch this task, except for the home - // task which we always return. + if (!mAllowed) { + // Skip if the caller isn't allowed to fetch this task return; } }