Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make mutable PendingIntent explicit

Browse Source 
Starting from target SDK U, we will block creation of mutable
PendingIntents with implicit Intents because attackers can mutate the
Intent object within and launch altered behavior on behalf of victim
apps. For more details on the vulnerability, see go/pendingintent-rca.

From a quick analysis, we concluded that the PendingIntent here was only
destined to the test app/to the app, so it was made explicit. Reviewers,
please call out if this is not the case.

Bug: 236704164
Bug: 229362273
Test: atest RemoteInputViewTest
Test: atest InflatedSmartRepliesTest
Test: atest HeadsUpManagerTest
Test: atest SmartReplyViewTest
Test: atest NotificationUiAdjustmentTest
Test: atest NotificationInterruptStateProviderImplTest
Change-Id: Icfc653910fac99acfab74bb513d0df5b73183ca7
This commit is contained in:
Azhara Assanova
2023-01-06 18:19:36 +00:00
parent 397065c0f1
commit f2b59bfc5c
6 changed files with 38 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
packages/SystemUI/tests/src/com/android/systemui/statusbar/NotificationUiAdjustmentTest.java
View File

@@ -39,11 +39,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase {
@Test
public void needReinflate_differentLength() {
// TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below
// with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE.
PendingIntent pendingIntent =
PendingIntent.getActivity(mContext, 0, new Intent(),
PendingIntent.FLAG_MUTABLE_UNAUDITED);
PendingIntent.getActivity(mContext, 0,
new Intent().setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
Notification.Action action =
createActionBuilder("first", R.drawable.ic_corp_icon, pendingIntent).build();
assertThat(NotificationUiAdjustment.needReinflate(
@@ -54,11 +53,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase {
@Test
public void needReinflate_differentLabels() {
// TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below
// with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE.
PendingIntent pendingIntent =
PendingIntent.getActivity(mContext, 0, new Intent(),
PendingIntent.FLAG_MUTABLE_UNAUDITED);
PendingIntent.getActivity(mContext, 0,
new Intent().setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
Notification.Action firstAction =
createActionBuilder("first", R.drawable.ic_corp_icon, pendingIntent).build();
Notification.Action secondAction =
@@ -72,11 +70,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase {
@Test
public void needReinflate_differentIcons() {
// TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below
// with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE.
PendingIntent pendingIntent =
PendingIntent.getActivity(mContext, 0, new Intent(),
PendingIntent.FLAG_MUTABLE_UNAUDITED);
PendingIntent.getActivity(mContext, 0,
new Intent().setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
Notification.Action firstAction =
createActionBuilder("same", R.drawable.ic_corp_icon, pendingIntent).build();
Notification.Action secondAction =
@@ -91,14 +88,15 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase {
@Test
public void needReinflate_differentPendingIntent() {
// TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below
// with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE.
PendingIntent firstPendingIntent =
PendingIntent.getActivity(mContext, 0, new Intent(Intent.ACTION_VIEW),
PendingIntent.FLAG_MUTABLE_UNAUDITED);
PendingIntent.getActivity(mContext, 0,
new Intent(Intent.ACTION_VIEW).setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
PendingIntent secondPendingIntent =
PendingIntent.getActivity(mContext, 0, new Intent(Intent.ACTION_PROCESS_TEXT),
PendingIntent.FLAG_MUTABLE_UNAUDITED);
PendingIntent.getActivity(mContext, 0,
new Intent(Intent.ACTION_PROCESS_TEXT)
.setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
Notification.Action firstAction =
createActionBuilder("same", R.drawable.ic_corp_icon, firstPendingIntent)
.build();
@@ -114,11 +112,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase {
@Test
public void needReinflate_differentChoices() {
// TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below
// with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE.
PendingIntent pendingIntent =
PendingIntent.getActivity(mContext, 0, new Intent(),
PendingIntent.FLAG_MUTABLE_UNAUDITED);
PendingIntent.getActivity(mContext, 0,
new Intent().setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
RemoteInput firstRemoteInput =
createRemoteInput("same", "same", new CharSequence[] {"first"});
@@ -142,11 +139,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase {
@Test
public void needReinflate_differentRemoteInputLabel() {
// TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below
// with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE.
PendingIntent pendingIntent =
PendingIntent.getActivity(mContext, 0, new Intent(),
PendingIntent.FLAG_MUTABLE_UNAUDITED);
PendingIntent.getActivity(mContext, 0,
new Intent().setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
RemoteInput firstRemoteInput =
createRemoteInput("same", "first", new CharSequence[] {"same"});
@@ -170,11 +166,10 @@ public class NotificationUiAdjustmentTest extends SysuiTestCase {
@Test
public void needReinflate_negative() {
// TODO(b/174258598) Please replace FLAG_MUTABLE_UNAUDITED below
// with either FLAG_IMMUTABLE (recommended) or FLAG_MUTABLE.
PendingIntent pendingIntent =
PendingIntent.getActivity(mContext, 0, new Intent(),
PendingIntent.FLAG_MUTABLE_UNAUDITED);
PendingIntent.getActivity(mContext, 0,
new Intent().setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
RemoteInput firstRemoteInput =
createRemoteInput("same", "same", new CharSequence[] {"same"});
RemoteInput secondRemoteInput =

3
packages/SystemUI/tests/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImplTest.java
View File

@@ -885,7 +885,8 @@ public class NotificationInterruptStateProviderImplTest extends SysuiTestCase {
private NotificationEntry createBubble(String groupKey, Integer groupAlert) {
Notification.BubbleMetadata data = new Notification.BubbleMetadata.Builder(
PendingIntent.getActivity(mContext, 0, new Intent(),
PendingIntent.getActivity(mContext, 0,
new Intent().setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE),
Icon.createWithResource(mContext.getResources(), R.drawable.android))
.build();

2
packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/HeadsUpManagerTest.java
View File

@@ -197,7 +197,7 @@ public class HeadsUpManagerTest extends AlertingNotificationManagerTest {
public void testPinEntry_logsPeek() {
// Needs full screen intent in order to be pinned
final PendingIntent fullScreenIntent = PendingIntent.getActivity(mContext, 0,
new Intent(), PendingIntent.FLAG_MUTABLE);
new Intent().setPackage(mContext.getPackageName()), PendingIntent.FLAG_MUTABLE);
HeadsUpManager.HeadsUpEntry entryToPin = mHeadsUpManager.new HeadsUpEntry();
entryToPin.setEntry(new NotificationEntryBuilder()

6
packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/InflatedSmartRepliesTest.java
View File

@@ -574,7 +574,8 @@ public class InflatedSmartRepliesTest extends SysuiTestCase {
private void setupAppGeneratedReplies(
CharSequence[] smartReplies, boolean allowSystemGeneratedReplies) {
PendingIntent pendingIntent =
PendingIntent.getBroadcast(mContext, 0, TEST_INTENT,
PendingIntent.getBroadcast(mContext, 0,
TEST_INTENT.setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
Notification.Action action =
new Notification.Action.Builder(null, "Test Action", pendingIntent).build();
@@ -606,7 +607,8 @@ public class InflatedSmartRepliesTest extends SysuiTestCase {
}
private Notification.Action.Builder createActionBuilder(String actionTitle, Intent intent) {
PendingIntent pendingIntent = PendingIntent.getBroadcast(mContext, 0, intent,
PendingIntent pendingIntent = PendingIntent.getBroadcast(mContext, 0,
intent.setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
return new Notification.Action.Builder(mActionIcon, actionTitle, pendingIntent);
}

3
packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/RemoteInputViewTest.java
View File

@@ -140,7 +140,8 @@ public class RemoteInputViewTest extends SysuiTestCase {
private void setTestPendingIntent(RemoteInputViewController controller) {
PendingIntent pendingIntent = PendingIntent.getBroadcast(mContext, 0,
new Intent(TEST_ACTION), PendingIntent.FLAG_MUTABLE);
new Intent(TEST_ACTION).setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
RemoteInput input = new RemoteInput.Builder(TEST_RESULT_KEY).build();
RemoteInput[] inputs = {input};

6
packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/SmartReplyViewTest.java
View File

@@ -488,7 +488,8 @@ public class SmartReplyViewTest extends SysuiTestCase {
private SmartReplyView.SmartReplies createSmartReplies(CharSequence[] choices,
boolean fromAssistant) {
PendingIntent pendingIntent =
PendingIntent.getBroadcast(mContext, 0, new Intent(TEST_ACTION),
PendingIntent.getBroadcast(mContext, 0,
new Intent(TEST_ACTION).setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
RemoteInput input = new RemoteInput.Builder(TEST_RESULT_KEY).setChoices(choices).build();
return new SmartReplyView.SmartReplies(
@@ -505,7 +506,8 @@ public class SmartReplyViewTest extends SysuiTestCase {
private Notification.Action createAction(String actionTitle) {
PendingIntent pendingIntent = PendingIntent.getBroadcast(mContext, 0,
new Intent(TEST_ACTION), PendingIntent.FLAG_MUTABLE);
new Intent(TEST_ACTION).setPackage(mContext.getPackageName()),
PendingIntent.FLAG_MUTABLE);
return new Notification.Action.Builder(mActionIcon, actionTitle, pendingIntent).build();
}