From c5944b179e2fc98aa5fca114ccc49276b0b9566c Mon Sep 17 00:00:00 2001
From: Santiago Seifert <aquilescanta@google.com>
Date: Wed, 4 Jan 2023 17:30:07 +0000
Subject: [PATCH] Enforce MEDIA_CONTENT_CONTROL in verifyPackageName

Also rename verifyPackageName to verifyPackageExists,
which probably reflects behavior a bit better.

Before this change, an app can use a direct binder
call to ask the system whether a package is installed
without having any permissions. Since the method now
requires MEDIA_CONTENT_CONTROL, we don't need
enforceMediaContentControlPermission anymore.

Bug: 205124386
Test: atest MediaRouter2HostSideTest CtsMediaBetterTogetherTestCases
Change-Id: I66723a00cf8b22b40aa0cd680a7dbe4bb71fddb6
---
 .../android/media/IMediaRouterService.aidl    |  3 +--
 media/java/android/media/MediaRouter2.java    |  6 ++---
 .../server/media/MediaRouter2ServiceImpl.java | 27 +++++++------------
 .../server/media/MediaRouterService.java      | 10 ++-----
 4 files changed, 16 insertions(+), 30 deletions(-)

diff --git a/media/java/android/media/IMediaRouterService.aidl b/media/java/android/media/IMediaRouterService.aidl
index f6a9162cda39b..aa7e4df181861 100644
--- a/media/java/android/media/IMediaRouterService.aidl
+++ b/media/java/android/media/IMediaRouterService.aidl
@@ -50,8 +50,7 @@ interface IMediaRouterService {
     // MediaRouterService.java for readability.
 
     // Methods for MediaRouter2
-    boolean verifyPackageName(String clientPackageName);
-    void enforceMediaContentControlPermission();
+    boolean verifyPackageExists(String clientPackageName);
     List<MediaRoute2Info> getSystemRoutes();
     RoutingSessionInfo getSystemSessionInfo();
 
diff --git a/media/java/android/media/MediaRouter2.java b/media/java/android/media/MediaRouter2.java
index 5faa794151b1a..fa74a9f12d7c4 100644
--- a/media/java/android/media/MediaRouter2.java
+++ b/media/java/android/media/MediaRouter2.java
@@ -208,9 +208,9 @@ public final class MediaRouter2 {
                 IMediaRouterService.Stub.asInterface(
                         ServiceManager.getService(Context.MEDIA_ROUTER_SERVICE));
         try {
-            // SecurityException will be thrown if there's no permission.
-            serviceBinder.enforceMediaContentControlPermission();
-            if (!serviceBinder.verifyPackageName(clientPackageName)) {
+            // verifyPackageExists throws SecurityException if the caller doesn't hold
+            // MEDIA_CONTENT_CONTROL permission.
+            if (!serviceBinder.verifyPackageExists(clientPackageName)) {
                 Log.e(TAG, "Package " + clientPackageName + " not found. Ignoring.");
                 return null;
             }
diff --git a/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java b/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
index 5e01ddbfbf779..2e31a4a4c86e5 100644
--- a/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
+++ b/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
@@ -154,29 +154,22 @@ class MediaRouter2ServiceImpl {
     // Start of methods that implement MediaRouter2 operations.
 
     @NonNull
-    public boolean verifyPackageName(@NonNull String clientPackageName) {
-        final long token = Binder.clearCallingIdentity();
-
-        try {
-            PackageManager pm = mContext.getPackageManager();
-            pm.getPackageInfo(clientPackageName, PackageManager.PackageInfoFlags.of(0));
-            return true;
-        } catch (PackageManager.NameNotFoundException ex) {
-            return false;
-        } finally {
-            Binder.restoreCallingIdentity(token);
-        }
-    }
-
-    @NonNull
-    public void enforceMediaContentControlPermission() {
+    public boolean verifyPackageExists(@NonNull String clientPackageName) {
         final int pid = Binder.getCallingPid();
         final int uid = Binder.getCallingUid();
         final long token = Binder.clearCallingIdentity();
 
         try {
-            mContext.enforcePermission(Manifest.permission.MEDIA_CONTENT_CONTROL, pid, uid,
+            mContext.enforcePermission(
+                    Manifest.permission.MEDIA_CONTENT_CONTROL,
+                    pid,
+                    uid,
                     "Must hold MEDIA_CONTENT_CONTROL permission.");
+            PackageManager pm = mContext.getPackageManager();
+            pm.getPackageInfo(clientPackageName, PackageManager.PackageInfoFlags.of(0));
+            return true;
+        } catch (PackageManager.NameNotFoundException ex) {
+            return false;
         } finally {
             Binder.restoreCallingIdentity(token);
         }
diff --git a/services/core/java/com/android/server/media/MediaRouterService.java b/services/core/java/com/android/server/media/MediaRouterService.java
index ad82e1c786e39..3ad0e44e6ea35 100644
--- a/services/core/java/com/android/server/media/MediaRouterService.java
+++ b/services/core/java/com/android/server/media/MediaRouterService.java
@@ -380,14 +380,8 @@ public final class MediaRouterService extends IMediaRouterService.Stub
 
     // Binder call
     @Override
-    public boolean verifyPackageName(String clientPackageName) {
-        return mService2.verifyPackageName(clientPackageName);
-    }
-
-    // Binder call
-    @Override
-    public void enforceMediaContentControlPermission() {
-        mService2.enforceMediaContentControlPermission();
+    public boolean verifyPackageExists(String clientPackageName) {
+        return mService2.verifyPackageExists(clientPackageName);
     }
 
     // Binder call