Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make mutable PendingIntent explicit

Browse Source 
Starting from target SDK U, we will block creation of mutable
PendingIntents with implicit Intents because attackers can mutate the
Intent object within and launch altered behavior on behalf of victim
apps. For more details on the vulnerability, see go/pendingintent-rca.

From a quick analysis, we concluded that the PendingIntent here was only
destined to the test app/to the app, so it was made explicit. Reviewers,
please call out if this is not the case.

Bug: 236704164
Bug: 229362273
Test: atest ShortcutManagerTest9
Test: atest ShortcutManagerTest8
Test: atest RecoverySnapshotListenersStorageTest
Test: atest RecoverableKeyStoreManagerTest
Change-Id: Ib6bc41c6985e90e6b7d42a5b509686996c9c5425
This commit is contained in:
Azhara Assanova
2023-01-06 18:30:58 +00:00
parent 72c4f6d3de
commit edf5330813
4 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java
View File

@@ -1073,7 +1073,9 @@ public class RecoverableKeyStoreManagerTest {
int uid = Binder.getCallingUid();
PendingIntent intent = PendingIntent.getBroadcast(
InstrumentationRegistry.getTargetContext(), /*requestCode=*/1,
new Intent(), /*flags=*/ PendingIntent.FLAG_MUTABLE_UNAUDITED);
new Intent()
.setPackage(InstrumentationRegistry.getTargetContext().getPackageName()),
/*flags=*/ PendingIntent.FLAG_MUTABLE);
mRecoverableKeyStoreManager.setSnapshotCreatedPendingIntent(intent);
verify(mMockListenersStorage).setSnapshotListener(eq(uid), any(PendingIntent.class));
}

12
services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverySnapshotListenersStorageTest.java
View File

@@ -41,7 +41,9 @@ public class RecoverySnapshotListenersStorageTest {
int recoveryAgentUid = 1000;
PendingIntent intent = PendingIntent.getBroadcast(
InstrumentationRegistry.getTargetContext(), /*requestCode=*/ 1,
new Intent(), /*flags=*/ PendingIntent.FLAG_MUTABLE_UNAUDITED);
new Intent()
.setPackage(InstrumentationRegistry.getTargetContext().getPackageName()),
/*flags=*/ PendingIntent.FLAG_MUTABLE);
mStorage.setSnapshotListener(recoveryAgentUid, intent);
assertTrue(mStorage.hasListener(recoveryAgentUid));
@@ -54,7 +56,9 @@ public class RecoverySnapshotListenersStorageTest {
int recoveryAgentUid = 1000;
mStorage.recoverySnapshotAvailable(recoveryAgentUid);
PendingIntent intent = PendingIntent.getBroadcast(
context, /*requestCode=*/ 0, new Intent(TEST_INTENT_ACTION), /*flags=*/PendingIntent.FLAG_MUTABLE_UNAUDITED);
context, /*requestCode=*/ 0,
new Intent(TEST_INTENT_ACTION).setPackage(context.getPackageName()),
/*flags=*/PendingIntent.FLAG_MUTABLE);
CountDownLatch latch = new CountDownLatch(1);
context.registerReceiver(new BroadcastReceiver() {
@Override
@@ -75,7 +79,9 @@ public class RecoverySnapshotListenersStorageTest {
int recoveryAgentUid = 1000;
mStorage.recoverySnapshotAvailable(recoveryAgentUid);
PendingIntent intent = PendingIntent.getBroadcast(
context, /*requestCode=*/ 0, new Intent(TEST_INTENT_ACTION), /*flags=*/PendingIntent.FLAG_MUTABLE_UNAUDITED);
context, /*requestCode=*/ 0,
new Intent(TEST_INTENT_ACTION).setPackage(context.getPackageName()),
/*flags=*/PendingIntent.FLAG_MUTABLE);
CountDownLatch latch = new CountDownLatch(2);
BroadcastReceiver broadcastReceiver = new BroadcastReceiver() {
@Override

4
services/tests/servicestests/src/com/android/server/pm/ShortcutManagerTest8.java
View File

@@ -327,7 +327,9 @@ public class ShortcutManagerTest8 extends BaseShortcutManagerTest {
}
private IntentSender makeResultIntent() {
return PendingIntent.getActivity(getTestContext(), 0, new Intent(), PendingIntent.FLAG_MUTABLE_UNAUDITED).getIntentSender();
return PendingIntent.getActivity(getTestContext(), 0,
new Intent().setPackage(getTestContext().getPackageName()),
PendingIntent.FLAG_MUTABLE).getIntentSender();
}
public void testRequestPinShortcut_withCallback() {

4
services/tests/servicestests/src/com/android/server/pm/ShortcutManagerTest9.java
View File

@@ -150,7 +150,9 @@ public class ShortcutManagerTest9 extends BaseShortcutManagerTest {
public void testRequestPinAppWidget_withCallback() {
final PendingIntent resultIntent =
PendingIntent.getActivity(getTestContext(), 0, new Intent(), PendingIntent.FLAG_MUTABLE_UNAUDITED);
PendingIntent.getActivity(getTestContext(), 0,
new Intent().setPackage(getTestContext().getPackageName()),
PendingIntent.FLAG_MUTABLE);
checkRequestPinAppWidget(resultIntent);
}