From 07eaaab3cf9dfa693cc7a675ba508ab1da717460 Mon Sep 17 00:00:00 2001
From: Gaurav Bhola <gauravbhola@google.com>
Date: Mon, 16 May 2022 16:21:57 -0700
Subject: [PATCH] Fix ClipboardService's auto-clearing where wrong uid was
 being used.

- Autoclear option was not clearing the clipboard because auto-clear path was using Binder.getCallingUid() instead of the uid to resolve the userId which the primary clip is set against.

Fix: 232809658
Test: atest ClipboardAutoClearTest
Change-Id: Iae4f1a1d7cbc85212916658cd779e806ebdf2270
---
 .../android/server/clipboard/ClipboardService.java    | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/services/core/java/com/android/server/clipboard/ClipboardService.java b/services/core/java/com/android/server/clipboard/ClipboardService.java
index 3f002449c1eb9..61350bb6095e9 100644
--- a/services/core/java/com/android/server/clipboard/ClipboardService.java
+++ b/services/core/java/com/android/server/clipboard/ClipboardService.java
@@ -380,12 +380,12 @@ public class ClipboardService extends SystemService {
             }
             checkDataOwner(clip, intendingUid);
             synchronized (mLock) {
-                scheduleAutoClear(userId);
+                scheduleAutoClear(userId, intendingUid);
                 setPrimaryClipInternalLocked(clip, intendingUid, sourcePackage);
             }
         }
 
-        private void scheduleAutoClear(@UserIdInt int userId) {
+        private void scheduleAutoClear(@UserIdInt int userId, int intendingUid) {
             final long oldIdentity = Binder.clearCallingIdentity();
             try {
                 if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_CLIPBOARD,
@@ -393,7 +393,7 @@ public class ClipboardService extends SystemService {
                     mClipboardClearHandler.removeEqualMessages(ClipboardClearHandler.MSG_CLEAR,
                             userId);
                     Message clearMessage = Message.obtain(mClipboardClearHandler,
-                            ClipboardClearHandler.MSG_CLEAR, userId, 0, userId);
+                            ClipboardClearHandler.MSG_CLEAR, userId, intendingUid, userId);
                     mClipboardClearHandler.sendMessageDelayed(clearMessage,
                             getTimeoutForAutoClear());
                 }
@@ -446,7 +446,7 @@ public class ClipboardService extends SystemService {
                 showAccessNotificationLocked(pkg, intendingUid, intendingUserId, clipboard);
                 notifyTextClassifierLocked(clipboard, pkg, intendingUid);
                 if (clipboard.primaryClip != null) {
-                    scheduleAutoClear(userId);
+                    scheduleAutoClear(userId, intendingUid);
                 }
                 return clipboard.primaryClip;
             }
@@ -554,11 +554,12 @@ public class ClipboardService extends SystemService {
                 switch (msg.what) {
                     case MSG_CLEAR:
                         final int userId = msg.arg1;
+                        final int intendingUid = msg.arg2;
                         synchronized (mLock) {
                             if (getClipboardLocked(userId).primaryClip != null) {
                                 FrameworkStatsLog.write(FrameworkStatsLog.CLIPBOARD_CLEARED,
                                         FrameworkStatsLog.CLIPBOARD_CLEARED__SOURCE__AUTO_CLEAR);
-                                setPrimaryClipInternalLocked(null, Binder.getCallingUid(), null);
+                                setPrimaryClipInternalLocked(null, intendingUid, null);
                             }
                         }
                         break;