Add safer Bundle APIs that take an extra Class<T> argument that checks
that the type about to be deserialized is a child of the type passed in
parameter *before* actually deserializing it, while also deprecating old
APIs.
This allows use to reap the benefits of the new typed Parcel APIs and
enhances security.
Only the APIs that could involve custom object injection are modified.
So, besides the obvious ones that have that design (eg.
readParcelableList()), subtler cases such as readIntegerArrayList()
could result in custom object deserialization, and since it's all
generics, even the casting inside Bundle wouldn't fail, only after the
client unpacked the list items would it blow up. Now those are checked
beforehand.
Since Bundle always calls Parcel.readValue() under the hood (instead of
specialized APIs such as readParcelable() etc), we had to augment that
method (that's used by LazyValue when retrieving the item) to accept
item types now for containers, which I implemented as a vararg of
Class<?> parameters (this is all private/@hide). This way we could
retrieve a list of intents like readValue(.., List.class, Intent.class),
or a map of string to intents like readValue(.., Map.class,
String.class, Intent.class). For non-container items, we can just pass
no arguments for the vararg. This is explained in internal javadocs.
Inside readValue() now, we also check the container types before
calling the internal methods for deserialization. So, if the thing on
the wire is a VAL_MAP and we know the method we're about to call will
return a HashMap, we verify that the type passed in parameter is a super
type of that (if it's non-null, if it's null it means "perform no
check").
Now, LazyValue became a BiFunction<Class<?>, Class<?>[], Object> to
receive those extra "item types" for containers. The reason for
separating the first from the rest is that the first defines the return
type in the new APIs and inside Parcel, so we need the T from Class<T>
to ensure type-safety.
(I was torn here between using BiFunction or just exposing LazyValue as
@hide for Bundle since it feels like we're missing meaning/abstraction,
but end up leaving this way, advise if you'd prefer the other way)
There was a bit of a refactor in Parcel so readValue() could call
internal methods that accepted nullable Class<?> parameters with the
meaning that null = "no verification" and non-null = "check against
type provided" (because the external APIs all require non-null
parameters).
Now we can return null in all cases when there is a type mismatch. Note
that the Bundle APIs catch ClassCastException to return null, but that
only works for non-generic types (eg. getSizeF()). For generic types
wrapping "return (T) o" with try-catch doesn't work because the type
gets erased to its bound at runtime, so the type mismatch escapes that
try-catch to the caller, potentially causing a crash. Now they happen
inside the getters, as the non-generic ones.
Test: Boots for now
Test: Working on CTS
Test: atest -d android.os.cts.ParcelTest android.os.cts.BundleTest android.os.BundleTest android.os.ParcelTest
CTS-Coverage-Bug: 219980813
Change-Id: Ifcbeb34b4684d7de105756b9d414162a9205ffaa
After reviewing rendered docs, adding missing paragraph markers
and some small typos, as well as fixing code snippets to be inside a <pre> block. At the
moment, trailing newlines get picked up so it's also necessary to
terminate the code and pre blocks on the actual last line of code.
Test: built docs and manually reviewed site
Change-Id: I327b146eaae20fa3a2e8cf066e211e14cb165c51
Now that we have an official cloud media provider, exempt backup jobs
for that provider's app instead of the gallery app.
Bug: 218361620
Test: atest CtsPhotoPickerTest
Change-Id: Ic8487cdf7883894d9a4c1d654f779c98edf69cb8
Currently we have a few APIs for isXXXProfile. In the case of managed
profiles, we cachce the results.
Here, we introduce a new hidden API getProfileType, which gets and
caches the user type (string), if the user type is a profile. That way,
we automatically have the caching benefits for all profiles, not just
managed profiles.
We only do this for profiles because they have a relaxed permission
requirement. Other user types have strong restrictions, so we do not use
their more general getters here.
Test: atest UserManagerTest
Change-Id: I36b4caead83954518d6fc48860af61f8988f19a9
Fixed CDD link rendering in javadoc for
getStorageVolumesIncludingSharedProfiles
Bug: 217627738
Test: Verify the javadoc by opening the generated html pages in browser
Change-Id: Ib5a7e52b44a6b5bc11f17fe3a8e726649c6b70bc
This reverts commit 761d4a0ccf.
Reason for revert: A fix can solve the issue for which this revert was created
Bug: 196856709
Bug: 218391941
Bug: 218267535
Test: Safetynet test
Test: health/mpts/heavyweight
Ignore-AOSP-First: pending fix for logcat privacy issue
Change-Id: I54222244b2aa6a9f307ed61629608abe12db1e3d
Does not remove Support Library artifacts from docs classpath (ApiDocs.bp)
because they are still used in development/samples, which is not as easy
to migrate as javadoc.
Bug: 158779503
Test: make docs
Exempt-From-Owner-Approval: Mass find/replace for androidx migration
Change-Id: Icf7f53ec36a0e970413352e2ebf40ce9d60ed17e
The sysprop is needed to avoid JNI when accessing KNOWN_CODENAMES
from native code.
Bug: 211747008
Test: atest android.os.cts.BuildTest#testBuildCodenameConstants
Change-Id: I713a122655f5f8a6a2fed5cee61bbe4094acbeb8
Provider a safer API getParcelable() that takes a Class<?> parameter
just like the safer Parcel APIs introduced, so we check the type before
deserializing, preventing unexpected and potentially vulnerable code
being executed (technique used in the bugs).
Making it @hide since ASA requested this in T (more details on bugs)
and the urgent usage is inside the platform, we can flesh out a public
API for U.
Test: App code gpaste/6130483466338304 logs gpaste/5148052949041152
Bug: 213169612
Bug: 212804042
Bug: 212803946
Bug: 210885162
Change-Id: Ieebc044043e0776e71d35c1cc11be9299f972c45
