Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Preventing component spoofing during getShortcutIntent" into sc-dev

Browse Source
This commit is contained in:
TreeHugger Robot
2021-06-08 18:21:21 +00:00
committed by Android (Google) Code Review
parent 4bb784103f 3997eaa6fb
commit f59889a08f
4 changed files with 37 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
core/java/android/app/ActivityManagerInternal.java
View File

@@ -603,6 +603,14 @@ public abstract class ActivityManagerInternal {
int requestCode, @NonNull Intent intent, int flags, Bundle options,
String ownerPkgName, int ownerUid);
/**
* Effectively PendingIntent.getActivityForUser(), but the PendingIntent is
* owned by the given uid rather than by the caller (i.e. the system).
*/
public abstract PendingIntent getPendingIntentActivityAsApp(
int requestCode, @NonNull Intent[] intents, int flags, Bundle options,
String ownerPkgName, int ownerUid);
/**
* @return mBootTimeTempAllowlistDuration of ActivityManagerConstants.
*/

24
services/core/java/com/android/server/am/ActivityManagerService.java
View File

@@ -16178,6 +16178,14 @@ public class ActivityManagerService extends IActivityManager.Stub
public PendingIntent getPendingIntentActivityAsApp(
int requestCode, @NonNull Intent intent, int flags, Bundle options,
String ownerPkg, int ownerUid) {
return getPendingIntentActivityAsApp(requestCode, new Intent[] { intent }, flags,
options, ownerPkg, ownerUid);
}
@Override
public PendingIntent getPendingIntentActivityAsApp(
int requestCode, @NonNull Intent[] intents, int flags, Bundle options,
String ownerPkg, int ownerUid) {
// system callers must explicitly set mutability state
final boolean flagImmutableSet = (flags & PendingIntent.FLAG_IMMUTABLE) != 0;
final boolean flagMutableSet = (flags & PendingIntent.FLAG_MUTABLE) != 0;
@@ -16187,15 +16195,21 @@ public class ActivityManagerService extends IActivityManager.Stub
}
final Context context = ActivityManagerService.this.mContext;
String resolvedType = intent.resolveTypeIfNeeded(context.getContentResolver());
intent.migrateExtraStreamToClipData(context);
intent.prepareToLeaveProcess(context);
final ContentResolver resolver = context.getContentResolver();
final int len = intents.length;
final String[] resolvedTypes = new String[len];
for (int i = 0; i < len; i++) {
final Intent intent = intents[i];
resolvedTypes[i] = intent.resolveTypeIfNeeded(resolver);
intent.migrateExtraStreamToClipData(context);
intent.prepareToLeaveProcess(context);
}
IIntentSender target =
ActivityManagerService.this.getIntentSenderWithFeatureAsApp(
INTENT_SENDER_ACTIVITY, ownerPkg,
context.getAttributionTag(), null, null, requestCode,
new Intent[] { intent },
resolvedType != null ? new String[] { resolvedType } : null,
intents,
resolvedTypes,
flags, options, UserHandle.getUserId(ownerUid), ownerUid);
return target != null ? new PendingIntent(target) : null;
}

17
services/core/java/com/android/server/pm/LauncherAppsService.java
View File

@@ -698,14 +698,13 @@ public class LauncherAppsService extends SystemService {
}
final long ident = Binder.clearCallingIdentity();
try {
return injectCreatePendingIntent(mContext.createPackageContextAsUser(packageName,
0, user), 0 /* requestCode */, intents, FLAG_MUTABLE, opts, user);
} catch (PackageManager.NameNotFoundException e) {
Slog.e(TAG, "Cannot create pending intent from shortcut " + shortcutId, e);
return injectCreatePendingIntent(0 /* requestCode */, intents,
FLAG_MUTABLE, opts, packageName, mPackageManagerInternal.getPackageUid(
packageName, PackageManager.MATCH_DIRECT_BOOT_AUTO,
user.getIdentifier()));
} finally {
Binder.restoreCallingIdentity(ident);
}
return null;
}
@Override
@@ -812,10 +811,10 @@ public class LauncherAppsService extends SystemService {
}
@VisibleForTesting
PendingIntent injectCreatePendingIntent(Context context, int requestCode,
@NonNull Intent[] intents, int flags, Bundle options, UserHandle user) {
return PendingIntent.getActivitiesAsUser(context, requestCode, intents, flags, options,
user);
PendingIntent injectCreatePendingIntent(int requestCode, @NonNull Intent[] intents,
int flags, Bundle options, String ownerPackage, int ownerUserId) {
return mActivityManagerInternal.getPendingIntentActivityAsApp(requestCode, intents,
flags, options, ownerPackage, ownerUserId);
}
@Override

4
services/tests/servicestests/src/com/android/server/pm/BaseShortcutManagerTest.java
View File

@@ -635,8 +635,8 @@ public abstract class BaseShortcutManagerTest extends InstrumentationTestCase {
}
@Override
PendingIntent injectCreatePendingIntent(Context context, int requestCode,
@NonNull Intent[] intents, int flags, Bundle options, UserHandle user) {
PendingIntent injectCreatePendingIntent(int requestCode, @NonNull Intent[] intents,
int flags, Bundle options, String ownerPackage, int ownerUserId) {
return new PendingIntent(mock(IIntentSender.class));
}
}