From edf533081313337a37321d5215998d68f4ccae18 Mon Sep 17 00:00:00 2001 From: Azhara Assanova Date: Fri, 6 Jan 2023 18:30:58 +0000 Subject: [PATCH] Make mutable PendingIntent explicit Starting from target SDK U, we will block creation of mutable PendingIntents with implicit Intents because attackers can mutate the Intent object within and launch altered behavior on behalf of victim apps. For more details on the vulnerability, see go/pendingintent-rca. From a quick analysis, we concluded that the PendingIntent here was only destined to the test app/to the app, so it was made explicit. Reviewers, please call out if this is not the case. Bug: 236704164 Bug: 229362273 Test: atest ShortcutManagerTest9 Test: atest ShortcutManagerTest8 Test: atest RecoverySnapshotListenersStorageTest Test: atest RecoverableKeyStoreManagerTest Change-Id: Ib6bc41c6985e90e6b7d42a5b509686996c9c5425 --- .../RecoverableKeyStoreManagerTest.java | 4 +++- .../RecoverySnapshotListenersStorageTest.java | 12 +++++++++--- .../com/android/server/pm/ShortcutManagerTest8.java | 4 +++- .../com/android/server/pm/ShortcutManagerTest9.java | 4 +++- 4 files changed, 18 insertions(+), 6 deletions(-) diff --git a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java index 281195de4b354..1b983f0bfb1b6 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java @@ -1073,7 +1073,9 @@ public class RecoverableKeyStoreManagerTest { int uid = Binder.getCallingUid(); PendingIntent intent = PendingIntent.getBroadcast( InstrumentationRegistry.getTargetContext(), /*requestCode=*/1, - new Intent(), /*flags=*/ PendingIntent.FLAG_MUTABLE_UNAUDITED); + new Intent() + .setPackage(InstrumentationRegistry.getTargetContext().getPackageName()), + /*flags=*/ PendingIntent.FLAG_MUTABLE); mRecoverableKeyStoreManager.setSnapshotCreatedPendingIntent(intent); verify(mMockListenersStorage).setSnapshotListener(eq(uid), any(PendingIntent.class)); } diff --git a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverySnapshotListenersStorageTest.java b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverySnapshotListenersStorageTest.java index d9ebb4c26891c..418d474523306 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverySnapshotListenersStorageTest.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverySnapshotListenersStorageTest.java @@ -41,7 +41,9 @@ public class RecoverySnapshotListenersStorageTest { int recoveryAgentUid = 1000; PendingIntent intent = PendingIntent.getBroadcast( InstrumentationRegistry.getTargetContext(), /*requestCode=*/ 1, - new Intent(), /*flags=*/ PendingIntent.FLAG_MUTABLE_UNAUDITED); + new Intent() + .setPackage(InstrumentationRegistry.getTargetContext().getPackageName()), + /*flags=*/ PendingIntent.FLAG_MUTABLE); mStorage.setSnapshotListener(recoveryAgentUid, intent); assertTrue(mStorage.hasListener(recoveryAgentUid)); @@ -54,7 +56,9 @@ public class RecoverySnapshotListenersStorageTest { int recoveryAgentUid = 1000; mStorage.recoverySnapshotAvailable(recoveryAgentUid); PendingIntent intent = PendingIntent.getBroadcast( - context, /*requestCode=*/ 0, new Intent(TEST_INTENT_ACTION), /*flags=*/PendingIntent.FLAG_MUTABLE_UNAUDITED); + context, /*requestCode=*/ 0, + new Intent(TEST_INTENT_ACTION).setPackage(context.getPackageName()), + /*flags=*/PendingIntent.FLAG_MUTABLE); CountDownLatch latch = new CountDownLatch(1); context.registerReceiver(new BroadcastReceiver() { @Override @@ -75,7 +79,9 @@ public class RecoverySnapshotListenersStorageTest { int recoveryAgentUid = 1000; mStorage.recoverySnapshotAvailable(recoveryAgentUid); PendingIntent intent = PendingIntent.getBroadcast( - context, /*requestCode=*/ 0, new Intent(TEST_INTENT_ACTION), /*flags=*/PendingIntent.FLAG_MUTABLE_UNAUDITED); + context, /*requestCode=*/ 0, + new Intent(TEST_INTENT_ACTION).setPackage(context.getPackageName()), + /*flags=*/PendingIntent.FLAG_MUTABLE); CountDownLatch latch = new CountDownLatch(2); BroadcastReceiver broadcastReceiver = new BroadcastReceiver() { @Override diff --git a/services/tests/servicestests/src/com/android/server/pm/ShortcutManagerTest8.java b/services/tests/servicestests/src/com/android/server/pm/ShortcutManagerTest8.java index 2293808a5d646..a85c7227b9543 100644 --- a/services/tests/servicestests/src/com/android/server/pm/ShortcutManagerTest8.java +++ b/services/tests/servicestests/src/com/android/server/pm/ShortcutManagerTest8.java @@ -327,7 +327,9 @@ public class ShortcutManagerTest8 extends BaseShortcutManagerTest { } private IntentSender makeResultIntent() { - return PendingIntent.getActivity(getTestContext(), 0, new Intent(), PendingIntent.FLAG_MUTABLE_UNAUDITED).getIntentSender(); + return PendingIntent.getActivity(getTestContext(), 0, + new Intent().setPackage(getTestContext().getPackageName()), + PendingIntent.FLAG_MUTABLE).getIntentSender(); } public void testRequestPinShortcut_withCallback() { diff --git a/services/tests/servicestests/src/com/android/server/pm/ShortcutManagerTest9.java b/services/tests/servicestests/src/com/android/server/pm/ShortcutManagerTest9.java index a47a8df51c9fb..2fca3d07149e6 100644 --- a/services/tests/servicestests/src/com/android/server/pm/ShortcutManagerTest9.java +++ b/services/tests/servicestests/src/com/android/server/pm/ShortcutManagerTest9.java @@ -150,7 +150,9 @@ public class ShortcutManagerTest9 extends BaseShortcutManagerTest { public void testRequestPinAppWidget_withCallback() { final PendingIntent resultIntent = - PendingIntent.getActivity(getTestContext(), 0, new Intent(), PendingIntent.FLAG_MUTABLE_UNAUDITED); + PendingIntent.getActivity(getTestContext(), 0, + new Intent().setPackage(getTestContext().getPackageName()), + PendingIntent.FLAG_MUTABLE); checkRequestPinAppWidget(resultIntent); }