From 8669ef385780b8415412407deec85539a1e7db98 Mon Sep 17 00:00:00 2001 From: lumark Date: Mon, 10 Feb 2020 18:41:57 +0800 Subject: [PATCH] Restrict app transition maximum duration As WindowState#startAnimation for restricting window animation duration (currently is 10 secs), For security reason, we also need to restrict app transition animation duration as 3 secs to prevent malicious app may set a long duration or infinity repeat counts through ActivityOption#makeCustomAnimation or Activity#overridePendingTransition with custom animation set. Bug: 145728687 Test: manual as issue provided test app Change-Id: I39051d6e4d2b681ce2becbafe14aab3f3d8ebf6b --- .../java/com/android/server/wm/AppTransition.java | 1 + .../java/com/android/server/wm/WindowContainer.java | 12 +++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/services/core/java/com/android/server/wm/AppTransition.java b/services/core/java/com/android/server/wm/AppTransition.java index ca09537f6ad01..499b6a51ba235 100644 --- a/services/core/java/com/android/server/wm/AppTransition.java +++ b/services/core/java/com/android/server/wm/AppTransition.java @@ -172,6 +172,7 @@ public class AppTransition implements Dump { private static final int MAX_CLIP_REVEAL_TRANSITION_DURATION = 420; private static final int THUMBNAIL_APP_TRANSITION_DURATION = 336; private static final long APP_TRANSITION_TIMEOUT_MS = 5000; + static final int MAX_APP_TRANSITION_DURATION = 3 * 1000; // 3 secs. private final Context mContext; private final WindowManagerService mService; diff --git a/services/core/java/com/android/server/wm/WindowContainer.java b/services/core/java/com/android/server/wm/WindowContainer.java index a0a70dc6a1d76..b12c6980cccef 100644 --- a/services/core/java/com/android/server/wm/WindowContainer.java +++ b/services/core/java/com/android/server/wm/WindowContainer.java @@ -29,6 +29,7 @@ import static android.os.UserHandle.USER_NULL; import static android.view.SurfaceControl.Transaction; import static com.android.server.policy.WindowManagerPolicy.FINISH_LAYOUT_REDO_WALLPAPER; +import static com.android.server.wm.AppTransition.MAX_APP_TRANSITION_DURATION; import static com.android.server.wm.IdentifierProto.HASH_CODE; import static com.android.server.wm.IdentifierProto.TITLE; import static com.android.server.wm.IdentifierProto.USER_ID; @@ -2172,7 +2173,16 @@ class WindowContainer extends ConfigurationContainer< displayConfig.uiMode, displayConfig.orientation, frame, displayFrame, insets, surfaceInsets, stableInsets, isVoiceInteraction, inFreeformWindowingMode(), this); if (a != null) { - if (DEBUG_ANIM) logWithStack(TAG, "Loaded animation " + a + " for " + this); + if (a != null) { + // Setup the maximum app transition duration to prevent malicious app may set a long + // animation duration or infinite repeat counts for the app transition through + // ActivityOption#makeCustomAnimation or WindowManager#overridePendingTransition. + a.restrictDuration(MAX_APP_TRANSITION_DURATION); + } + if (DEBUG_ANIM) { + logWithStack(TAG, "Loaded animation " + a + " for " + this + + ", duration: " + ((a != null) ? a.getDuration() : 0)); + } final int containingWidth = frame.width(); final int containingHeight = frame.height(); a.initialize(containingWidth, containingHeight, width, height);