From 58bcea62b002daef6656493c99f47db03b05f57e Mon Sep 17 00:00:00 2001
From: Patrick Baumann <patb@google.com>
Date: Tue, 25 Feb 2020 17:30:36 -0800
Subject: [PATCH] Only grant visibility to result reciever

This change modifies which package is made visible to the receiving end
of a startForResult call. Prior to this change it was the callingUid,
which, in the case of startActivityForResult was typically the same as
the recipient of the result (or the return of getCallingPackage()). It
didn't account for forwarded results or startIntentSenderForResult.
Instead, we now look up the uid of the resultTo ActivityRecord and grant
the recipient of the intent access to it.

Bug: 149810887
Test: atest AppEnumerationTests
Change-Id: I331db9e75ca70635da589d3620d8723668d26b60
---
 .../com/android/server/wm/ActivityStarter.java     | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/services/core/java/com/android/server/wm/ActivityStarter.java b/services/core/java/com/android/server/wm/ActivityStarter.java
index 32103048469f5..1bfedc759f943 100644
--- a/services/core/java/com/android/server/wm/ActivityStarter.java
+++ b/services/core/java/com/android/server/wm/ActivityStarter.java
@@ -1563,10 +1563,16 @@ class ActivityStarter {
 
         mService.mUgmInternal.grantUriPermissionFromIntent(mCallingUid, mStartActivity.packageName,
                 mIntent, mStartActivity.getUriPermissionsLocked(), mStartActivity.mUserId);
-        mService.getPackageManagerInternalLocked().grantImplicitAccess(
-                mStartActivity.mUserId, mIntent,
-                UserHandle.getAppId(mStartActivity.info.applicationInfo.uid), mCallingUid,
-                true /*direct*/);
+        if (mStartActivity.resultTo != null && mStartActivity.resultTo.info != null) {
+            // we need to resolve resultTo to a uid as grantImplicitAccess deals explicitly in UIDs
+            final PackageManagerInternal pmInternal =
+                    mService.getPackageManagerInternalLocked();
+            final int resultToUid = pmInternal.getPackageUidInternal(
+                            mStartActivity.resultTo.info.packageName, 0, mStartActivity.mUserId);
+            pmInternal.grantImplicitAccess(mStartActivity.mUserId, mIntent,
+                    UserHandle.getAppId(mStartActivity.info.applicationInfo.uid) /*recipient*/,
+                    resultToUid /*visible*/, true /*direct*/);
+        }
         if (newTask) {
             EventLogTags.writeWmCreateTask(mStartActivity.mUserId,
                     mStartActivity.getTask().mTaskId);