From cb419edfb72fefb183727f6d7ff78eeea9d8b4ed Mon Sep 17 00:00:00 2001 From: Azhara Assanova Date: Wed, 11 Jan 2023 18:41:54 +0000 Subject: [PATCH] Make mutable implicit PendingIntent immutable Starting from target SDK U, we will block creation of mutable PendingIntents with implicit Intents because attackers can mutate the Intent object within and launch altered behavior on behalf of victim apps. For more details on the vulnerability, see go/pendingintent-rca. From a quick analysis, we concluded that the PendingIntent here is only mutated with flags from fillInIntent, so we added them to the intent inside and made the PendingIntent immutable. Reviewers, please call out if this is not the case. Bug: 236704164 Bug: 229362273 Test: CtsVerifier: Bubble Notification Tests Test: atest frameworks/base/libs/WindowManager/Shell/tests/unittest/src/com/android/wm/shell/bubbles Change-Id: Idda5868f193070908afd435cedac72a03b6c4439 --- .../com/android/wm/shell/bubbles/BubbleExpandedView.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/libs/WindowManager/Shell/src/com/android/wm/shell/bubbles/BubbleExpandedView.java b/libs/WindowManager/Shell/src/com/android/wm/shell/bubbles/BubbleExpandedView.java index 8121b206c93a2..e85b3c7d5bc30 100644 --- a/libs/WindowManager/Shell/src/com/android/wm/shell/bubbles/BubbleExpandedView.java +++ b/libs/WindowManager/Shell/src/com/android/wm/shell/bubbles/BubbleExpandedView.java @@ -232,10 +232,13 @@ public class BubbleExpandedView extends LinearLayout { if (mBubble.isAppBubble()) { PendingIntent pi = PendingIntent.getActivity(mContext, 0, - mBubble.getAppBubbleIntent(), - PendingIntent.FLAG_MUTABLE, + mBubble.getAppBubbleIntent() + .addFlags(FLAG_ACTIVITY_NEW_DOCUMENT) + .addFlags(FLAG_ACTIVITY_MULTIPLE_TASK), + PendingIntent.FLAG_IMMUTABLE, null); - mTaskView.startActivity(pi, fillInIntent, options, launchBounds); + mTaskView.startActivity(pi, /* fillInIntent= */ null, options, + launchBounds); } else if (!mIsOverflow && mBubble.hasMetadataShortcutId()) { options.setApplyActivityFlagsForBubbles(true); mTaskView.startShortcutActivity(mBubble.getShortcutInfo(),