Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Security issue for Html.fromHtml without escape

Browse Source 
Add Html.escapeHtml() for the string and also remove profileName
for the confirmation_title to make sure the confirmation_title always
show the device's name.

Bug: 172251622
Bug: 197035186
Test: Manual
Change-Id: I7e2f95fd85e18127dc481f188ace8ad6effc4831
This commit is contained in:
Evan Chen
2021-08-13 19:40:04 +00:00
committed by Erik Wolsheimer
parent 2db6435bb2
commit 8f005ffe4a
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
packages/CompanionDeviceManager/src/com/android/companiondevicemanager/CompanionDeviceActivity.java
View File

@@ -93,9 +93,9 @@ public class CompanionDeviceActivity extends Activity {
final DeviceFilterPair selectedDevice = getService().mDevicesFound.get(0);
setTitle(Html.fromHtml(getString(
R.string.confirmation_title,
getCallingAppName(),
profileName,
selectedDevice.getDisplayName()), 0));
Html.escapeHtml(getCallingAppName()),
Html.escapeHtml(selectedDevice.getDisplayName())), 0));
mPairButton = findViewById(R.id.button_pair);
mPairButton.setOnClickListener(v -> onDeviceConfirmed(getService().mSelectedDevice));
getService().mSelectedDevice = selectedDevice;
@@ -108,8 +108,8 @@ public class CompanionDeviceActivity extends Activity {
mPairButton = findViewById(R.id.button_pair);
mPairButton.setVisibility(View.GONE);
setTitle(Html.fromHtml(getString(R.string.chooser_title,
profileName,
getCallingAppName()), 0));
Html.escapeHtml(profileName),
Html.escapeHtml(getCallingAppName())), 0));
mDeviceListView = findViewById(R.id.device_list);
mDevicesAdapter = new DevicesAdapter();
mDeviceListView.setAdapter(mDevicesAdapter);