From 23b8d4979fe1b4d428d85a519d50c090c480bc03 Mon Sep 17 00:00:00 2001
From: Curtis Belmonte <curtislb@google.com>
Date: Tue, 4 Feb 2020 14:24:39 -0800
Subject: [PATCH] Set secure window flag for AuthContainerView

Marks the window in which AuthContainerView is shown as secure in order
to prevent it from being screenshotted. This matches the behavior of
ConfirmDeviceCredentialActivity in Settings.

Test: atest AuthContainerViewTest
Test: Manual:
1. Use TestDPC to set up work profile
2. Set a PIN for the work profile in Settings > Security
3. Lock and unlock the device with non-work PIN
4. Launch a work app to be prompted for the work PIN
5. Attempt to take a screenshot

Before: Able to take a screenshot of the credential activity

After: Not able to take a screenshot

Fixes: 148000618
Change-Id: Ib1ac94915d28d8d88ec6a81292b69db396c419f9
---
 .../android/systemui/biometrics/AuthContainerView.java |  4 +++-
 .../systemui/biometrics/AuthContainerViewTest.java     | 10 ++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/packages/SystemUI/src/com/android/systemui/biometrics/AuthContainerView.java b/packages/SystemUI/src/com/android/systemui/biometrics/AuthContainerView.java
index b8d32aec30e33..5c65977c89294 100644
--- a/packages/SystemUI/src/com/android/systemui/biometrics/AuthContainerView.java
+++ b/packages/SystemUI/src/com/android/systemui/biometrics/AuthContainerView.java
@@ -583,11 +583,13 @@ public class AuthContainerView extends LinearLayout
      * @return
      */
     public static WindowManager.LayoutParams getLayoutParams(IBinder windowToken) {
+        final int windowFlags = WindowManager.LayoutParams.FLAG_HARDWARE_ACCELERATED
+                | WindowManager.LayoutParams.FLAG_SECURE;
         final WindowManager.LayoutParams lp = new WindowManager.LayoutParams(
                 ViewGroup.LayoutParams.MATCH_PARENT,
                 ViewGroup.LayoutParams.MATCH_PARENT,
                 WindowManager.LayoutParams.TYPE_STATUS_BAR_PANEL,
-                WindowManager.LayoutParams.FLAG_HARDWARE_ACCELERATED,
+                windowFlags,
                 PixelFormat.TRANSLUCENT);
         lp.privateFlags |= WindowManager.LayoutParams.SYSTEM_FLAG_SHOW_FOR_ALL_USERS;
         lp.setTitle("BiometricPrompt");
diff --git a/packages/SystemUI/tests/src/com/android/systemui/biometrics/AuthContainerViewTest.java b/packages/SystemUI/tests/src/com/android/systemui/biometrics/AuthContainerViewTest.java
index f2642594802d1..486aac894d9b4 100644
--- a/packages/SystemUI/tests/src/com/android/systemui/biometrics/AuthContainerViewTest.java
+++ b/packages/SystemUI/tests/src/com/android/systemui/biometrics/AuthContainerViewTest.java
@@ -36,6 +36,7 @@ import android.content.Context;
 import android.hardware.biometrics.BiometricAuthenticator;
 import android.hardware.biometrics.BiometricPrompt;
 import android.os.Bundle;
+import android.os.IBinder;
 import android.os.UserManager;
 import android.test.suitebuilder.annotation.SmallTest;
 import android.testing.AndroidTestingRunner;
@@ -43,6 +44,7 @@ import android.testing.TestableLooper.RunWithLooper;
 import android.view.LayoutInflater;
 import android.view.View;
 import android.view.ViewGroup;
+import android.view.WindowManager;
 import android.widget.FrameLayout;
 import android.widget.ImageView;
 import android.widget.ScrollView;
@@ -175,6 +177,14 @@ public class AuthContainerViewTest extends SysuiTestCase {
         assertEquals(Utils.CREDENTIAL_PATTERN, mAuthContainer.mCredentialView.mCredentialType);
     }
 
+    @Test
+    public void testLayoutParams_hasSecureWindowFlag() {
+        final IBinder windowToken = mock(IBinder.class);
+        final WindowManager.LayoutParams layoutParams =
+                AuthContainerView.getLayoutParams(windowToken);
+        assertTrue((layoutParams.flags & WindowManager.LayoutParams.FLAG_SECURE) != 0);
+    }
+
     private void initializeContainer(int authenticators) {
         AuthContainerView.Config config = new AuthContainerView.Config();
         config.mContext = mContext;