From f2b59bfc5c0a027b4319fb50cf0281e77df7e1fe Mon Sep 17 00:00:00 2001 From: Azhara Assanova Date: Fri, 6 Jan 2023 18:19:36 +0000 Subject: [PATCH] Make mutable PendingIntent explicit Starting from target SDK U, we will block creation of mutable PendingIntents with implicit Intents because attackers can mutate the Intent object within and launch altered behavior on behalf of victim apps. For more details on the vulnerability, see go/pendingintent-rca. From a quick analysis, we concluded that the PendingIntent here was only destined to the test app/to the app, so it was made explicit. Reviewers, please call out if this is not the case. Bug: 236704164 Bug: 229362273 Test: atest RemoteInputViewTest Test: atest InflatedSmartRepliesTest Test: atest HeadsUpManagerTest Test: atest SmartReplyViewTest Test: atest NotificationUiAdjustmentTest Test: atest NotificationInterruptStateProviderImplTest Change-Id: Icfc653910fac99acfab74bb513d0df5b73183ca7 --- .../NotificationUiAdjustmentTest.java | 55 +++++++++---------- ...icationInterruptStateProviderImplTest.java | 3 +- .../statusbar/policy/HeadsUpManagerTest.java | 2 +- .../policy/InflatedSmartRepliesTest.java | 6 +- .../statusbar/policy/RemoteInputViewTest.java | 3 +- .../statusbar/policy/SmartReplyViewTest.java | 6 +- 6 files changed, 38 insertions(+), 37 deletions(-) diff --git a/packages/SystemUI/tests/src/com/android/systemui/statusbar/NotificationUiAdjustmentTest.java b/packages/SystemUI/tests/src/com/android/systemui/statusbar/NotificationUiAdjustmentTest.java index 4d8949562e084..3b85dbacc6992 100644 --- a/packages/SystemUI/tests/src/com/android/systemui/statusbar/NotificationUiAdjustmentTest.java +++ b/packages/SystemUI/tests/src/com/android/systemui/statusbar/NotificationUiAdjustmentTest.java @@ -39,11 +39,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase { @Test public void needReinflate_differentLength() { - // TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below - // with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE. PendingIntent pendingIntent = - PendingIntent.getActivity(mContext, 0, new Intent(), - PendingIntent.FLAG_MUTABLE_UNAUDITED); + PendingIntent.getActivity(mContext, 0, + new Intent().setPackage(mContext.getPackageName()), + PendingIntent.FLAG_MUTABLE); Notification.Action action = createActionBuilder("first", R.drawable.ic_corp_icon, pendingIntent).build(); assertThat(NotificationUiAdjustment.needReinflate( @@ -54,11 +53,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase { @Test public void needReinflate_differentLabels() { - // TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below - // with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE. PendingIntent pendingIntent = - PendingIntent.getActivity(mContext, 0, new Intent(), - PendingIntent.FLAG_MUTABLE_UNAUDITED); + PendingIntent.getActivity(mContext, 0, + new Intent().setPackage(mContext.getPackageName()), + PendingIntent.FLAG_MUTABLE); Notification.Action firstAction = createActionBuilder("first", R.drawable.ic_corp_icon, pendingIntent).build(); Notification.Action secondAction = @@ -72,11 +70,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase { @Test public void needReinflate_differentIcons() { - // TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below - // with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE. PendingIntent pendingIntent = - PendingIntent.getActivity(mContext, 0, new Intent(), - PendingIntent.FLAG_MUTABLE_UNAUDITED); + PendingIntent.getActivity(mContext, 0, + new Intent().setPackage(mContext.getPackageName()), + PendingIntent.FLAG_MUTABLE); Notification.Action firstAction = createActionBuilder("same", R.drawable.ic_corp_icon, pendingIntent).build(); Notification.Action secondAction = @@ -91,14 +88,15 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase { @Test public void needReinflate_differentPendingIntent() { - // TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below - // with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE. PendingIntent firstPendingIntent = - PendingIntent.getActivity(mContext, 0, new Intent(Intent.ACTION_VIEW), - PendingIntent.FLAG_MUTABLE_UNAUDITED); + PendingIntent.getActivity(mContext, 0, + new Intent(Intent.ACTION_VIEW).setPackage(mContext.getPackageName()), + PendingIntent.FLAG_MUTABLE); PendingIntent secondPendingIntent = - PendingIntent.getActivity(mContext, 0, new Intent(Intent.ACTION_PROCESS_TEXT), - PendingIntent.FLAG_MUTABLE_UNAUDITED); + PendingIntent.getActivity(mContext, 0, + new Intent(Intent.ACTION_PROCESS_TEXT) + .setPackage(mContext.getPackageName()), + PendingIntent.FLAG_MUTABLE); Notification.Action firstAction = createActionBuilder("same", R.drawable.ic_corp_icon, firstPendingIntent) .build(); @@ -114,11 +112,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase { @Test public void needReinflate_differentChoices() { - // TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below - // with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE. PendingIntent pendingIntent = - PendingIntent.getActivity(mContext, 0, new Intent(), - PendingIntent.FLAG_MUTABLE_UNAUDITED); + PendingIntent.getActivity(mContext, 0, + new Intent().setPackage(mContext.getPackageName()), + PendingIntent.FLAG_MUTABLE); RemoteInput firstRemoteInput = createRemoteInput("same", "same", new CharSequence[] {"first"}); @@ -142,11 +139,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase { @Test public void needReinflate_differentRemoteInputLabel() { - // TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below - // with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE. PendingIntent pendingIntent = - PendingIntent.getActivity(mContext, 0, new Intent(), - PendingIntent.FLAG_MUTABLE_UNAUDITED); + PendingIntent.getActivity(mContext, 0, + new Intent().setPackage(mContext.getPackageName()), + PendingIntent.FLAG_MUTABLE); RemoteInput firstRemoteInput = createRemoteInput("same", "first", new CharSequence[] {"same"}); @@ -170,11 +166,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase { @Test public void needReinflate_negative() { - // TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below - // with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE. PendingIntent pendingIntent = - PendingIntent.getActivity(mContext, 0, new Intent(), - PendingIntent.FLAG_MUTABLE_UNAUDITED); + PendingIntent.getActivity(mContext, 0, + new Intent().setPackage(mContext.getPackageName()), + PendingIntent.FLAG_MUTABLE); RemoteInput firstRemoteInput = createRemoteInput("same", "same", new CharSequence[] {"same"}); RemoteInput secondRemoteInput = diff --git a/packages/SystemUI/tests/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImplTest.java b/packages/SystemUI/tests/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImplTest.java index 601771d640469..58fe2a041a783 100644 --- a/packages/SystemUI/tests/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImplTest.java +++ b/packages/SystemUI/tests/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImplTest.java @@ -885,7 +885,8 @@ public class NotificationInterruptStateProviderImplTest extends SysuiTestCase { private NotificationEntry createBubble(String groupKey, Integer groupAlert) { Notification.BubbleMetadata data = new Notification.BubbleMetadata.Builder( - PendingIntent.getActivity(mContext, 0, new Intent(), + PendingIntent.getActivity(mContext, 0, + new Intent().setPackage(mContext.getPackageName()), PendingIntent.FLAG_MUTABLE), Icon.createWithResource(mContext.getResources(), R.drawable.android)) .build(); diff --git a/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/HeadsUpManagerTest.java b/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/HeadsUpManagerTest.java index 9764b8c07c2c1..4aa86c2752755 100644 --- a/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/HeadsUpManagerTest.java +++ b/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/HeadsUpManagerTest.java @@ -197,7 +197,7 @@ public class HeadsUpManagerTest extends AlertingNotificationManagerTest { public void testPinEntry_logsPeek() { // Needs full screen intent in order to be pinned final PendingIntent fullScreenIntent = PendingIntent.getActivity(mContext, 0, - new Intent(), PendingIntent.FLAG_MUTABLE); + new Intent().setPackage(mContext.getPackageName()), PendingIntent.FLAG_MUTABLE); HeadsUpManager.HeadsUpEntry entryToPin = mHeadsUpManager.new HeadsUpEntry(); entryToPin.setEntry(new NotificationEntryBuilder() diff --git a/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/InflatedSmartRepliesTest.java b/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/InflatedSmartRepliesTest.java index 5e2fa98178f47..85052e6004865 100644 --- a/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/InflatedSmartRepliesTest.java +++ b/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/InflatedSmartRepliesTest.java @@ -574,7 +574,8 @@ public class InflatedSmartRepliesTest extends SysuiTestCase { private void setupAppGeneratedReplies( CharSequence[] smartReplies, boolean allowSystemGeneratedReplies) { PendingIntent pendingIntent = - PendingIntent.getBroadcast(mContext, 0, TEST_INTENT, + PendingIntent.getBroadcast(mContext, 0, + TEST_INTENT.setPackage(mContext.getPackageName()), PendingIntent.FLAG_MUTABLE); Notification.Action action = new Notification.Action.Builder(null, "Test Action", pendingIntent).build(); @@ -606,7 +607,8 @@ public class InflatedSmartRepliesTest extends SysuiTestCase { } private Notification.Action.Builder createActionBuilder(String actionTitle, Intent intent) { - PendingIntent pendingIntent = PendingIntent.getBroadcast(mContext, 0, intent, + PendingIntent pendingIntent = PendingIntent.getBroadcast(mContext, 0, + intent.setPackage(mContext.getPackageName()), PendingIntent.FLAG_MUTABLE); return new Notification.Action.Builder(mActionIcon, actionTitle, pendingIntent); } diff --git a/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/RemoteInputViewTest.java b/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/RemoteInputViewTest.java index 4b32ee262cdc4..39bf00626e00f 100644 --- a/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/RemoteInputViewTest.java +++ b/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/RemoteInputViewTest.java @@ -140,7 +140,8 @@ public class RemoteInputViewTest extends SysuiTestCase { private void setTestPendingIntent(RemoteInputViewController controller) { PendingIntent pendingIntent = PendingIntent.getBroadcast(mContext, 0, - new Intent(TEST_ACTION), PendingIntent.FLAG_MUTABLE); + new Intent(TEST_ACTION).setPackage(mContext.getPackageName()), + PendingIntent.FLAG_MUTABLE); RemoteInput input = new RemoteInput.Builder(TEST_RESULT_KEY).build(); RemoteInput[] inputs = {input}; diff --git a/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/SmartReplyViewTest.java b/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/SmartReplyViewTest.java index a7ff59c6e919b..d9d8b6345fcb0 100644 --- a/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/SmartReplyViewTest.java +++ b/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/SmartReplyViewTest.java @@ -488,7 +488,8 @@ public class SmartReplyViewTest extends SysuiTestCase { private SmartReplyView.SmartReplies createSmartReplies(CharSequence[] choices, boolean fromAssistant) { PendingIntent pendingIntent = - PendingIntent.getBroadcast(mContext, 0, new Intent(TEST_ACTION), + PendingIntent.getBroadcast(mContext, 0, + new Intent(TEST_ACTION).setPackage(mContext.getPackageName()), PendingIntent.FLAG_MUTABLE); RemoteInput input = new RemoteInput.Builder(TEST_RESULT_KEY).setChoices(choices).build(); return new SmartReplyView.SmartReplies( @@ -505,7 +506,8 @@ public class SmartReplyViewTest extends SysuiTestCase { private Notification.Action createAction(String actionTitle) { PendingIntent pendingIntent = PendingIntent.getBroadcast(mContext, 0, - new Intent(TEST_ACTION), PendingIntent.FLAG_MUTABLE); + new Intent(TEST_ACTION).setPackage(mContext.getPackageName()), + PendingIntent.FLAG_MUTABLE); return new Notification.Action.Builder(mActionIcon, actionTitle, pendingIntent).build(); }