Merge "Preventing component spoofing during getShortcutIntent" into sc-dev

core/java/android/app/ActivityManagerInternal.java

@@ -603,6 +603,14 @@ public abstract class ActivityManagerInternal {
             int requestCode, @NonNull Intent intent, int flags, Bundle options,
             String ownerPkgName, int ownerUid);
 
+    /**
+     * Effectively PendingIntent.getActivityForUser(), but the PendingIntent is
+     * owned by the given uid rather than by the caller (i.e. the system).
+     */
+    public abstract PendingIntent getPendingIntentActivityAsApp(
+            int requestCode, @NonNull Intent[] intents, int flags, Bundle options,
+            String ownerPkgName, int ownerUid);
+
     /**
      * @return mBootTimeTempAllowlistDuration of ActivityManagerConstants.
      */

services/core/java/com/android/server/am/ActivityManagerService.java

@@ -16178,6 +16178,14 @@ public class ActivityManagerService extends IActivityManager.Stub
         public PendingIntent getPendingIntentActivityAsApp(
                 int requestCode, @NonNull Intent intent, int flags, Bundle options,
                 String ownerPkg, int ownerUid) {
+            return getPendingIntentActivityAsApp(requestCode, new Intent[] { intent }, flags,
+                    options, ownerPkg, ownerUid);
+        }
+
+        @Override
+        public PendingIntent getPendingIntentActivityAsApp(
+                int requestCode, @NonNull Intent[] intents, int flags, Bundle options,
+                String ownerPkg, int ownerUid) {
             // system callers must explicitly set mutability state
             final boolean flagImmutableSet = (flags & PendingIntent.FLAG_IMMUTABLE) != 0;
             final boolean flagMutableSet = (flags & PendingIntent.FLAG_MUTABLE) != 0;
@@ -16187,15 +16195,21 @@ public class ActivityManagerService extends IActivityManager.Stub
             }
 
             final Context context = ActivityManagerService.this.mContext;
-            String resolvedType = intent.resolveTypeIfNeeded(context.getContentResolver());
+            final ContentResolver resolver = context.getContentResolver();
-            intent.migrateExtraStreamToClipData(context);
+            final int len = intents.length;
-            intent.prepareToLeaveProcess(context);
+            final String[] resolvedTypes = new String[len];
+            for (int i = 0; i < len; i++) {
+                final Intent intent = intents[i];
+                resolvedTypes[i] = intent.resolveTypeIfNeeded(resolver);
+                intent.migrateExtraStreamToClipData(context);
+                intent.prepareToLeaveProcess(context);
+            }
             IIntentSender target =
                     ActivityManagerService.this.getIntentSenderWithFeatureAsApp(
                             INTENT_SENDER_ACTIVITY, ownerPkg,
                             context.getAttributionTag(), null, null, requestCode,
-                            new Intent[] { intent },
+                            intents,
-                            resolvedType != null ? new String[] { resolvedType } : null,
+                            resolvedTypes,
                             flags, options, UserHandle.getUserId(ownerUid), ownerUid);
             return target != null ? new PendingIntent(target) : null;
         }

services/core/java/com/android/server/pm/LauncherAppsService.java

@@ -698,14 +698,13 @@ public class LauncherAppsService extends SystemService {
             }
             final long ident = Binder.clearCallingIdentity();
             try {
-                return injectCreatePendingIntent(mContext.createPackageContextAsUser(packageName,
+                return injectCreatePendingIntent(0 /* requestCode */, intents,
-                        0, user), 0 /* requestCode */, intents, FLAG_MUTABLE, opts, user);
+                        FLAG_MUTABLE, opts, packageName, mPackageManagerInternal.getPackageUid(
-            } catch (PackageManager.NameNotFoundException e) {
+                                packageName, PackageManager.MATCH_DIRECT_BOOT_AUTO,
-                Slog.e(TAG, "Cannot create pending intent from shortcut " + shortcutId, e);
+                                user.getIdentifier()));
             } finally {
                 Binder.restoreCallingIdentity(ident);
             }
-            return null;
         }
 
         @Override
@@ -812,10 +811,10 @@ public class LauncherAppsService extends SystemService {
         }
 
         @VisibleForTesting
-        PendingIntent injectCreatePendingIntent(Context context, int requestCode,
+        PendingIntent injectCreatePendingIntent(int requestCode, @NonNull Intent[] intents,
-                @NonNull Intent[] intents, int flags, Bundle options, UserHandle user) {
+                int flags, Bundle options, String ownerPackage, int ownerUserId) {
-            return PendingIntent.getActivitiesAsUser(context, requestCode, intents, flags, options,
+            return mActivityManagerInternal.getPendingIntentActivityAsApp(requestCode, intents,
-                    user);
+                    flags, options, ownerPackage, ownerUserId);
         }
 
         @Override

services/tests/servicestests/src/com/android/server/pm/BaseShortcutManagerTest.java

@@ -635,8 +635,8 @@ public abstract class BaseShortcutManagerTest extends InstrumentationTestCase {
         }
 
         @Override
-        PendingIntent injectCreatePendingIntent(Context context, int requestCode,
+        PendingIntent injectCreatePendingIntent(int requestCode, @NonNull Intent[] intents,
-                @NonNull Intent[] intents, int flags, Bundle options, UserHandle user) {
+                int flags, Bundle options, String ownerPackage, int ownerUserId) {
             return new PendingIntent(mock(IIntentSender.class));
         }
     }