From 74ee11c3f4c19e92173b39cb8dc5a38ce7a7abe9 Mon Sep 17 00:00:00 2001 From: Bernardo Rufino Date: Tue, 21 Dec 2021 17:13:03 +0000 Subject: [PATCH] Migrate unsafer parcel APIs [2] Manually migrate the few cases of: * readArray() * readParcelableArray() To the new parcel APIs that take the expected type as the last parameter. This enhances security because it prevents unexpected types *before* running unparcelling code. More details at go/safer-parcel. Owners, please check that the type of the objects expected is always a subtype of the type provided as the 3rd parameter. This is usually easy to verify due to casts that happen shortly after. These changes often allowed further transformations but I decided to avoid them to keep this change small and targeted. This was manual since it's tricky to get lint to infer the type in those cases and it was only a few. Bug: 195622897 Test: TH passes Change-Id: I262ed7cd6d3bc15b32e9296e88a8a67fdb59e880 --- .../framework/java/android/media/Session2CommandGroup.java | 2 +- core/java/android/accessibilityservice/GestureDescription.java | 2 +- core/java/android/content/RestrictionEntry.java | 2 +- core/java/android/hardware/camera2/CaptureRequest.java | 3 ++- core/java/android/hardware/radio/RadioManager.java | 3 ++- core/java/android/print/PrintJobInfo.java | 2 +- .../android/ims/internal/uce/presence/PresResInstanceInfo.java | 2 +- .../com/android/internal/app/chooser/DisplayResolveInfo.java | 3 ++- core/java/com/android/internal/infra/AndroidFuture.java | 2 +- telephony/java/android/telephony/NetworkScanRequest.java | 3 ++- telephony/java/android/telephony/ims/ImsCallProfile.java | 3 ++- 11 files changed, 16 insertions(+), 11 deletions(-) diff --git a/apex/media/framework/java/android/media/Session2CommandGroup.java b/apex/media/framework/java/android/media/Session2CommandGroup.java index 13aabfc45ab70..af8184a27f0d2 100644 --- a/apex/media/framework/java/android/media/Session2CommandGroup.java +++ b/apex/media/framework/java/android/media/Session2CommandGroup.java @@ -68,7 +68,7 @@ public final class Session2CommandGroup implements Parcelable { /** * Used by parcelable creator. */ - @SuppressWarnings("WeakerAccess") /* synthetic access */ + @SuppressWarnings({"WeakerAccess", "UnsafeParcelApi"}) /* synthetic access */ Session2CommandGroup(Parcel in) { Parcelable[] commands = in.readParcelableArray(Session2Command.class.getClassLoader()); if (commands != null) { diff --git a/core/java/android/accessibilityservice/GestureDescription.java b/core/java/android/accessibilityservice/GestureDescription.java index a821dadf49489..857c5416b3bc8 100644 --- a/core/java/android/accessibilityservice/GestureDescription.java +++ b/core/java/android/accessibilityservice/GestureDescription.java @@ -525,7 +525,7 @@ public final class GestureDescription { public GestureStep(Parcel parcel) { timeSinceGestureStart = parcel.readLong(); Parcelable[] parcelables = - parcel.readParcelableArray(TouchPoint.class.getClassLoader()); + parcel.readParcelableArray(TouchPoint.class.getClassLoader(), TouchPoint.class); numTouchPoints = (parcelables == null) ? 0 : parcelables.length; touchPoints = new TouchPoint[numTouchPoints]; for (int i = 0; i < numTouchPoints; i++) { diff --git a/core/java/android/content/RestrictionEntry.java b/core/java/android/content/RestrictionEntry.java index 63fcb49fff1bd..8fd41f2c9e059 100644 --- a/core/java/android/content/RestrictionEntry.java +++ b/core/java/android/content/RestrictionEntry.java @@ -505,7 +505,7 @@ public class RestrictionEntry implements Parcelable { mChoiceValues = in.readStringArray(); mCurrentValue = in.readString(); mCurrentValues = in.readStringArray(); - Parcelable[] parcelables = in.readParcelableArray(null); + Parcelable[] parcelables = in.readParcelableArray(null, RestrictionEntry.class); if (parcelables != null) { mRestrictions = new RestrictionEntry[parcelables.length]; for (int i = 0; i < parcelables.length; i++) { diff --git a/core/java/android/hardware/camera2/CaptureRequest.java b/core/java/android/hardware/camera2/CaptureRequest.java index 86ae3a311c9b6..5df64e3cca9ec 100644 --- a/core/java/android/hardware/camera2/CaptureRequest.java +++ b/core/java/android/hardware/camera2/CaptureRequest.java @@ -599,7 +599,8 @@ public final class CaptureRequest extends CameraMetadata> synchronized (mSurfacesLock) { mSurfaceSet.clear(); - Parcelable[] parcelableArray = in.readParcelableArray(Surface.class.getClassLoader()); + Parcelable[] parcelableArray = in.readParcelableArray(Surface.class.getClassLoader(), + Surface.class); if (parcelableArray != null) { for (Parcelable p : parcelableArray) { Surface s = (Surface) p; diff --git a/core/java/android/hardware/radio/RadioManager.java b/core/java/android/hardware/radio/RadioManager.java index 6ea2ac4147040..4cc001a40146f 100644 --- a/core/java/android/hardware/radio/RadioManager.java +++ b/core/java/android/hardware/radio/RadioManager.java @@ -436,7 +436,8 @@ public class RadioManager { mNumAudioSources = in.readInt(); mIsInitializationRequired = in.readInt() == 1; mIsCaptureSupported = in.readInt() == 1; - Parcelable[] tmp = in.readParcelableArray(BandDescriptor.class.getClassLoader()); + Parcelable[] tmp = in.readParcelableArray(BandDescriptor.class.getClassLoader(), + BandDescriptor.class); mBands = new BandDescriptor[tmp.length]; for (int i = 0; i < tmp.length; i++) { mBands[i] = (BandDescriptor) tmp[i]; diff --git a/core/java/android/print/PrintJobInfo.java b/core/java/android/print/PrintJobInfo.java index 9bdfd8e69c00a..9d0c8d82ed0d5 100644 --- a/core/java/android/print/PrintJobInfo.java +++ b/core/java/android/print/PrintJobInfo.java @@ -240,7 +240,7 @@ public final class PrintJobInfo implements Parcelable { mTag = parcel.readString(); mCreationTime = parcel.readLong(); mCopies = parcel.readInt(); - Parcelable[] parcelables = parcel.readParcelableArray(null); + Parcelable[] parcelables = parcel.readParcelableArray(null, PageRange.class); if (parcelables != null) { mPageRanges = new PageRange[parcelables.length]; for (int i = 0; i < parcelables.length; i++) { diff --git a/core/java/com/android/ims/internal/uce/presence/PresResInstanceInfo.java b/core/java/com/android/ims/internal/uce/presence/PresResInstanceInfo.java index 733c0afff3672..0130ef47010aa 100644 --- a/core/java/com/android/ims/internal/uce/presence/PresResInstanceInfo.java +++ b/core/java/com/android/ims/internal/uce/presence/PresResInstanceInfo.java @@ -190,7 +190,7 @@ public class PresResInstanceInfo implements Parcelable{ mResInstanceState = source.readInt(); mPresentityUri = source.readString(); Parcelable[] tempParcelableArray = source.readParcelableArray( - PresTupleInfo.class.getClassLoader()); + PresTupleInfo.class.getClassLoader(), PresTupleInfo.class); mTupleInfoArray = new PresTupleInfo[] {}; if(tempParcelableArray != null) { mTupleInfoArray = Arrays.copyOf(tempParcelableArray, tempParcelableArray.length, diff --git a/core/java/com/android/internal/app/chooser/DisplayResolveInfo.java b/core/java/com/android/internal/app/chooser/DisplayResolveInfo.java index 289daee26f526..301de2d3529e9 100644 --- a/core/java/com/android/internal/app/chooser/DisplayResolveInfo.java +++ b/core/java/com/android/internal/app/chooser/DisplayResolveInfo.java @@ -239,7 +239,8 @@ public class DisplayResolveInfo implements TargetInfo, Parcelable { mExtendedInfo = in.readCharSequence(); mResolvedIntent = in.readParcelable(null /* ClassLoader */, android.content.Intent.class); mSourceIntents.addAll( - Arrays.asList((Intent[]) in.readParcelableArray(null /* ClassLoader */))); + Arrays.asList((Intent[]) in.readParcelableArray(null /* ClassLoader */, + Intent.class))); mIsSuspended = in.readBoolean(); mPinned = in.readBoolean(); mResolveInfo = in.readParcelable(null /* ClassLoader */, android.content.pm.ResolveInfo.class); diff --git a/core/java/com/android/internal/infra/AndroidFuture.java b/core/java/com/android/internal/infra/AndroidFuture.java index 84391c1699415..0443ad03b6ea5 100644 --- a/core/java/com/android/internal/infra/AndroidFuture.java +++ b/core/java/com/android/internal/infra/AndroidFuture.java @@ -24,7 +24,6 @@ import android.os.Looper; import android.os.Parcel; import android.os.Parcelable; import android.os.RemoteException; -import android.util.EventLog; import android.util.Log; import com.android.internal.annotations.GuardedBy; @@ -585,6 +584,7 @@ public class AndroidFuture extends CompletableFuture implements Parcelable /** * @see #writeThrowable */ + @SuppressWarnings("UnsafeParcelApi") private static @Nullable Throwable readThrowable(@NonNull Parcel parcel) { final boolean hasThrowable = parcel.readBoolean(); if (!hasThrowable) { diff --git a/telephony/java/android/telephony/NetworkScanRequest.java b/telephony/java/android/telephony/NetworkScanRequest.java index c8b8ffb9846b1..326f4171de3b6 100644 --- a/telephony/java/android/telephony/NetworkScanRequest.java +++ b/telephony/java/android/telephony/NetworkScanRequest.java @@ -221,7 +221,8 @@ public final class NetworkScanRequest implements Parcelable { private NetworkScanRequest(Parcel in) { mScanType = in.readInt(); - Parcelable[] tempSpecifiers = in.readParcelableArray(Object.class.getClassLoader()); + Parcelable[] tempSpecifiers = in.readParcelableArray(Object.class.getClassLoader(), + RadioAccessSpecifier.class); if (tempSpecifiers != null) { mSpecifiers = new RadioAccessSpecifier[tempSpecifiers.length]; for (int i = 0; i < tempSpecifiers.length; i++) { diff --git a/telephony/java/android/telephony/ims/ImsCallProfile.java b/telephony/java/android/telephony/ims/ImsCallProfile.java index 93e10583fbc01..b648de5762fde 100644 --- a/telephony/java/android/telephony/ims/ImsCallProfile.java +++ b/telephony/java/android/telephony/ims/ImsCallProfile.java @@ -847,7 +847,8 @@ public final class ImsCallProfile implements Parcelable { mHasKnownUserIntentEmergency = in.readBoolean(); mRestrictCause = in.readInt(); mCallerNumberVerificationStatus = in.readInt(); - Object[] accepted = in.readArray(RtpHeaderExtensionType.class.getClassLoader()); + Object[] accepted = in.readArray(RtpHeaderExtensionType.class.getClassLoader(), + RtpHeaderExtensionType.class); mAcceptedRtpHeaderExtensionTypes = Arrays.stream(accepted) .map(o -> (RtpHeaderExtensionType) o).collect(Collectors.toSet()); }