From 1d0387f0282adb9c91ce480cb3fe9fb883aae3c6 Mon Sep 17 00:00:00 2001
From: Yohei Yukawa <yukawa@google.com>
Date: Tue, 12 Jul 2022 19:32:03 -0700
Subject: [PATCH] Make IMMS#canShowInputMethodPickerLocked() self-contained

With this CL,

  InputMethodManagerService#canShowInputMethodPickerLocked()

becomes the only and unified verification mechanism about who can call

  IInputMethodManager#showInputMethodPickerFromClient().

This CL also fixes an edge case when a background IME process is
allowed to call that API when all the following conditions are met.

  A. The calling process has the same package name as the current IME
     for the foreground user, and
  B. The calling process has INTERACT_ACROSS_USERS_FULL permission.

It is quite unlikely that existing IMEs have relied on the above edge
case, because INTERACT_ACROSS_USERS_FULL is a system API that should
not be granted to IMEs in general.

Either way, with this CL, future readers should be able to understand
how the caller is verified more easily.

Bug: 34886274
Test: presubmit
Change-Id: I423b109bd55c13397e9236890ce72d043d1b7a89
---
 .../server/inputmethod/InputMethodManagerService.java    | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java b/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java
index 4886e6e14c17c..c27781a9fde55 100644
--- a/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java
+++ b/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java
@@ -3988,7 +3988,11 @@ public final class InputMethodManagerService extends IInputMethodManager.Stub
         if (mCurFocusedWindowClient != null && client != null
                 && mCurFocusedWindowClient.client.asBinder() == client.asBinder()) {
             return true;
-        } else if (getCurIntentLocked() != null && InputMethodUtils.checkIfPackageBelongsToUid(
+        }
+        if (mSettings.getCurrentUserId() != UserHandle.getUserId(uid)) {
+            return false;
+        }
+        if (getCurIntentLocked() != null && InputMethodUtils.checkIfPackageBelongsToUid(
                 mAppOpsManager,
                 uid,
                 getCurIntentLocked().getComponent().getPackageName())) {
@@ -4001,9 +4005,6 @@ public final class InputMethodManagerService extends IInputMethodManager.Stub
     public void showInputMethodPickerFromClient(IInputMethodClient client,
             int auxiliarySubtypeMode) {
         synchronized (ImfLock.class) {
-            if (!calledFromValidUserLocked()) {
-                return;
-            }
             if (!canShowInputMethodPickerLocked(client)) {
                 Slog.w(TAG, "Ignoring showInputMethodPickerFromClient of uid "
                         + Binder.getCallingUid() + ": " + client);