Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[RESTRICT AUTOMERGE] Ignore small source rect hint

Browse Source 
Which may be abused by malicious app to create a non-visible PiP
window that bypasses the background restriction.

Bug: 270368476
Test: Manually, using the POC app
Change-Id: Ifc0e4ffe8b7a9754053246069cb480aa6a59a7e1
This commit is contained in:
Hongwei Wang
2023-07-31 14:05:36 -07:00
parent 5d31bd1c3b
commit a54d763886
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
packages/SystemUI/src/com/android/systemui/pip/PipTaskOrganizer.java
View File

@@ -387,7 +387,8 @@ public class PipTaskOrganizer extends TaskOrganizer implements
final Rect currentBounds = mTaskInfo.configuration.windowConfiguration.getBounds(); final Rect currentBounds = mTaskInfo.configuration.windowConfiguration.getBounds();
if (mOneShotAnimationType == ANIM_TYPE_BOUNDS) { if (mOneShotAnimationType == ANIM_TYPE_BOUNDS) {
final Rect sourceHintRect = getValidSourceHintRect(info, currentBounds); final Rect sourceHintRect = getValidSourceHintRect(info, currentBounds,
destinationBounds);
scheduleAnimateResizePip(currentBounds, destinationBounds, sourceHintRect, scheduleAnimateResizePip(currentBounds, destinationBounds, sourceHintRect,
TRANSITION_DIRECTION_TO_PIP, mEnterExitAnimationDuration, TRANSITION_DIRECTION_TO_PIP, mEnterExitAnimationDuration,
null /* updateBoundsCallback */); null /* updateBoundsCallback */);
@@ -401,14 +402,17 @@ public class PipTaskOrganizer extends TaskOrganizer implements
/** /**
* Returns the source hint rect if it is valid (if provided and is contained by the current * Returns the source hint rect if it is valid (if provided and is contained by the current
* task bounds). * task bounds and not too small).
*/ */
private Rect getValidSourceHintRect(ActivityManager.RunningTaskInfo info, Rect sourceBounds) { private Rect getValidSourceHintRect(ActivityManager.RunningTaskInfo info, Rect sourceBounds,
Rect destinationBounds) {
final Rect sourceHintRect = info.pictureInPictureParams != null final Rect sourceHintRect = info.pictureInPictureParams != null
&& info.pictureInPictureParams.hasSourceBoundsHint() && info.pictureInPictureParams.hasSourceBoundsHint()
? info.pictureInPictureParams.getSourceRectHint() ? info.pictureInPictureParams.getSourceRectHint()
: null; : null;
if (sourceHintRect != null && sourceBounds.contains(sourceHintRect)) { if (sourceHintRect != null && sourceBounds.contains(sourceHintRect)
&& sourceHintRect.width() > destinationBounds.width()
&& sourceHintRect.height() > destinationBounds.height()) {
return sourceHintRect; return sourceHintRect;
} }
return null; return null;