From cdc8eecbd523f51f4d5b77325fa5e1ece9525b24 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Iv=C3=A1n=20Budnik?= <ivanbuper@google.com>
Date: Mon, 31 Jul 2023 15:44:34 +0000
Subject: [PATCH] Throw when setting RLP with privileged routers

Apps must only be able to set their own route listing preference.

Bug: 192657812
Test: atest MediaRouter2Test SystemMediaRouter2Test
Change-Id: I4782557f3c330226d435b1f78c971ee4af91887a
---
 media/java/android/media/MediaRouter2.java | 52 ++++++++++++++--------
 1 file changed, 34 insertions(+), 18 deletions(-)

diff --git a/media/java/android/media/MediaRouter2.java b/media/java/android/media/MediaRouter2.java
index f27a8dea737c4..6b67d1452debf 100644
--- a/media/java/android/media/MediaRouter2.java
+++ b/media/java/android/media/MediaRouter2.java
@@ -460,6 +460,9 @@ public final class MediaRouter2 {
      * updates} in order to keep the system UI in a consistent state. You can also call this method
      * at any other point to update the listing preference dynamically.
      *
+     * <p>Any calls to this method from a privileged router will throw an {@link
+     * UnsupportedOperationException}.
+     *
      * <p>Notes:
      *
      * <ol>
@@ -476,24 +479,7 @@ public final class MediaRouter2 {
      *     route listing. When null, the system uses its default listing criteria.
      */
     public void setRouteListingPreference(@Nullable RouteListingPreference routeListingPreference) {
-        synchronized (mLock) {
-            if (Objects.equals(mRouteListingPreference, routeListingPreference)) {
-                // Nothing changed. We return early to save a call to the system server.
-                return;
-            }
-            mRouteListingPreference = routeListingPreference;
-            try {
-                if (mStub == null) {
-                    MediaRouter2Stub stub = new MediaRouter2Stub();
-                    mMediaRouterService.registerRouter2(stub, mImpl.getPackageName());
-                    mStub = stub;
-                }
-                mMediaRouterService.setRouteListingPreference(mStub, mRouteListingPreference);
-            } catch (RemoteException ex) {
-                ex.rethrowFromSystemServer();
-            }
-            notifyRouteListingPreferenceUpdated(routeListingPreference);
-        }
+        mImpl.setRouteListingPreference(routeListingPreference);
     }
 
     /**
@@ -1962,6 +1948,8 @@ public final class MediaRouter2 {
 
         void unregisterRouteCallback();
 
+        void setRouteListingPreference(@Nullable RouteListingPreference preference);
+
         List<MediaRoute2Info> getAllRoutes();
 
         void setOnGetControllerHintsListener(OnGetControllerHintsListener listener);
@@ -2102,6 +2090,12 @@ public final class MediaRouter2 {
             // Do nothing.
         }
 
+        @Override
+        public void setRouteListingPreference(@Nullable RouteListingPreference preference) {
+            throw new UnsupportedOperationException(
+                    "RouteListingPreference cannot be set by a privileged MediaRouter2 instance.");
+        }
+
         /** Gets the list of all discovered routes. */
         @Override
         public List<MediaRoute2Info> getAllRoutes() {
@@ -2892,6 +2886,28 @@ public final class MediaRouter2 {
             }
         }
 
+        @Override
+        public void setRouteListingPreference(@Nullable RouteListingPreference preference) {
+            synchronized (mLock) {
+                if (Objects.equals(mRouteListingPreference, preference)) {
+                    // Nothing changed. We return early to save a call to the system server.
+                    return;
+                }
+                mRouteListingPreference = preference;
+                try {
+                    if (mStub == null) {
+                        MediaRouter2Stub stub = new MediaRouter2Stub();
+                        mMediaRouterService.registerRouter2(stub, mImpl.getPackageName());
+                        mStub = stub;
+                    }
+                    mMediaRouterService.setRouteListingPreference(mStub, mRouteListingPreference);
+                } catch (RemoteException ex) {
+                    ex.rethrowFromSystemServer();
+                }
+                notifyRouteListingPreferenceUpdated(preference);
+            }
+        }
+
         /**
          * Returns {@link Collections#emptyList()}. Local routes can only access routes related to
          * their {@link RouteDiscoveryPreference} through {@link #getRoutes()}.