Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict app transition maximum duration

Browse Source 
As WindowState#startAnimation for restricting window animation duration
(currently is 10 secs),

For security reason, we also need to restrict app transition animation
duration as 3 secs to prevent malicious app may set a long duration or
infinity repeat counts through ActivityOption#makeCustomAnimation or
Activity#overridePendingTransition with custom animation set.

Bug: 145728687
Test: manual as issue provided test app
Change-Id: I39051d6e4d2b681ce2becbafe14aab3f3d8ebf6b
This commit is contained in:
lumark
2020-02-10 18:41:57 +08:00
parent f416c7f9cd
commit 8669ef3857
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
services/core/java/com/android/server/wm/AppTransition.java
View File

@@ -172,6 +172,7 @@ public class AppTransition implements Dump {
private static final int MAX_CLIP_REVEAL_TRANSITION_DURATION = 420;
private static final int THUMBNAIL_APP_TRANSITION_DURATION = 336;
private static final long APP_TRANSITION_TIMEOUT_MS = 5000;
static final int MAX_APP_TRANSITION_DURATION = 3 * 1000; // 3 secs.
private final Context mContext;
private final WindowManagerService mService;

12
services/core/java/com/android/server/wm/WindowContainer.java
View File

@@ -29,6 +29,7 @@ import static android.os.UserHandle.USER_NULL;
import static android.view.SurfaceControl.Transaction;
import static com.android.server.policy.WindowManagerPolicy.FINISH_LAYOUT_REDO_WALLPAPER;
import static com.android.server.wm.AppTransition.MAX_APP_TRANSITION_DURATION;
import static com.android.server.wm.IdentifierProto.HASH_CODE;
import static com.android.server.wm.IdentifierProto.TITLE;
import static com.android.server.wm.IdentifierProto.USER_ID;
@@ -2172,7 +2173,16 @@ class WindowContainer<E extends WindowContainer> extends ConfigurationContainer<
displayConfig.uiMode, displayConfig.orientation, frame, displayFrame, insets,
surfaceInsets, stableInsets, isVoiceInteraction, inFreeformWindowingMode(), this);
if (a != null) {
if (DEBUG_ANIM) logWithStack(TAG, "Loaded animation " + a + " for " + this);
if (a != null) {
// Setup the maximum app transition duration to prevent malicious app may set a long
// animation duration or infinite repeat counts for the app transition through
// ActivityOption#makeCustomAnimation or WindowManager#overridePendingTransition.
a.restrictDuration(MAX_APP_TRANSITION_DURATION);
}
if (DEBUG_ANIM) {
logWithStack(TAG, "Loaded animation " + a + " for " + this
+ ", duration: " + ((a != null) ? a.getDuration() : 0));
}
final int containingWidth = frame.width();
final int containingHeight = frame.height();
a.initialize(containingWidth, containingHeight, width, height);