Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Protect and prevent app's activity token"

Browse Source
This commit is contained in:
Adam He
2019-08-12 18:36:03 +00:00
committed by Android (Google) Code Review
parent 9a73418069 7a188ae8ba
commit d5a2c65eb1
3 changed files with 45 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
services/autofill/java/com/android/server/autofill/Session.java
View File

@@ -887,7 +887,7 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
mMetricsLogger.write(log);
if (intentSender != null) {
if (sDebug) Slog.d(TAG, "Starting intent sender on save()");
startIntentSender(intentSender);
startIntentSenderAndFinishSession(intentSender);
}
// Nothing left to do...
@@ -1101,24 +1101,32 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
// AutoFillUiCallback
@Override
public void startIntentSender(IntentSender intentSender) {
public void startIntentSenderAndFinishSession(IntentSender intentSender) {
startIntentSender(intentSender, null);
}
// AutoFillUiCallback
@Override
public void startIntentSender(IntentSender intentSender, Intent intent) {
synchronized (mLock) {
if (mDestroyed) {
Slog.w(TAG, "Call to Session#startIntentSender() rejected - session: "
+ id + " destroyed");
return;
}
removeSelfLocked();
if (intent == null) {
removeSelfLocked();
}
}
mHandler.sendMessage(obtainMessage(
Session::doStartIntentSender,
this, intentSender));
this, intentSender, intent));
}
private void doStartIntentSender(IntentSender intentSender) {
private void doStartIntentSender(IntentSender intentSender, Intent intent) {
try {
synchronized (mLock) {
mClient.startIntentSender(intentSender, null);
mClient.startIntentSender(intentSender, intent);
}
} catch (RemoteException e) {
Slog.e(TAG, "Error launching auth intent", e);
@@ -1863,7 +1871,7 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
mHandler.sendMessage(obtainMessage(Session::logSaveShown, this));
final IAutoFillManagerClient client = getClient();
mPendingSaveUi = new PendingUi(mActivityToken, id, client);
mPendingSaveUi = new PendingUi(new Binder(), id, client);
final CharSequence serviceLabel;
final Drawable serviceIcon;

13
services/autofill/java/com/android/server/autofill/ui/AutoFillUI.java
View File

@@ -22,6 +22,7 @@ import android.annotation.NonNull;
import android.annotation.Nullable;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.IntentSender;
import android.graphics.drawable.Drawable;
import android.metrics.LogMaker;
@@ -82,7 +83,8 @@ public final class AutoFillUI {
void requestShowFillUi(AutofillId id, int width, int height,
IAutofillWindowPresenter presenter);
void requestHideFillUi(AutofillId id);
void startIntentSender(IntentSender intentSender);
void startIntentSenderAndFinishSession(IntentSender intentSender);
void startIntentSender(IntentSender intentSender, Intent intent);
void dispatchUnhandledKey(AutofillId id, KeyEvent keyEvent);
}
@@ -253,7 +255,7 @@ public final class AutoFillUI {
@Override
public void startIntentSender(IntentSender intentSender) {
if (mCallback != null) {
mCallback.startIntentSender(intentSender);
mCallback.startIntentSenderAndFinishSession(intentSender);
}
}
@@ -338,6 +340,13 @@ public final class AutoFillUI {
}
mMetricsLogger.write(log);
}
@Override
public void startIntentSender(IntentSender intentSender, Intent intent) {
if (mCallback != null) {
mCallback.startIntentSender(intentSender, intent);
}
}
}, mUiModeMgr.isNightMode(), isUpdate, compatMode);
});
}

37
services/autofill/java/com/android/server/autofill/ui/SaveUi.java
View File

@@ -32,7 +32,6 @@ import android.graphics.drawable.Drawable;
import android.metrics.LogMaker;
import android.os.Handler;
import android.os.IBinder;
import android.os.RemoteException;
import android.service.autofill.BatchUpdates;
import android.service.autofill.CustomDescription;
import android.service.autofill.InternalOnClickAction;
@@ -83,6 +82,7 @@ final class SaveUi {
void onSave();
void onCancel(IntentSender listener);
void onDestroy();
void startIntentSender(IntentSender intentSender, Intent intent);
}
/**
@@ -129,6 +129,15 @@ final class SaveUi {
mDone = true;
mRealListener.onDestroy();
}
@Override
public void startIntentSender(IntentSender intentSender, Intent intent) {
if (sDebug) Slog.d(TAG, "OneTimeListener.startIntentSender(): " + mDone);
if (mDone) {
return;
}
mRealListener.startIntentSender(intentSender, intent);
}
}
private final Handler mHandler = UiThread.getHandler();
@@ -168,8 +177,8 @@ final class SaveUi {
context = new ContextThemeWrapper(context, mThemeId) {
@Override
public void startActivity(Intent intent) {
intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
super.startActivity(intent);
PendingIntent p = PendingIntent.getActivity(this, 0, intent, 0);
mListener.startIntentSender(p.getIntentSender(), intent);
}
};
final LayoutInflater inflater = LayoutInflater.from(context);
@@ -329,21 +338,13 @@ final class SaveUi {
if (sVerbose) Slog.v(TAG, "Intercepting custom description intent");
final IBinder token = mPendingUi.getToken();
intent.putExtra(AutofillManager.EXTRA_RESTORE_SESSION_TOKEN, token);
try {
mPendingUi.client.startIntentSender(pendingIntent.getIntentSender(),
intent);
mPendingUi.setState(PendingUi.STATE_PENDING);
if (sDebug) Slog.d(TAG, "hiding UI until restored with token " + token);
hide();
log.setType(MetricsEvent.TYPE_OPEN);
mMetricsLogger.write(log);
return true;
} catch (RemoteException e) {
Slog.w(TAG, "error triggering pending intent: " + intent);
log.setType(MetricsEvent.TYPE_FAILURE);
mMetricsLogger.write(log);
return false;
}
mListener.startIntentSender(pendingIntent.getIntentSender(), intent);
mPendingUi.setState(PendingUi.STATE_PENDING);
if (sDebug) Slog.d(TAG, "hiding UI until restored with token " + token);
hide();
log.setType(MetricsEvent.TYPE_OPEN);
mMetricsLogger.write(log);
return true;
};
try {