Merge "fixes a security vulnerability in slice provider" into qt-dev (023af61a) · Commits · e / os / android_frameworks_base

core/java/android/app/slice/SliceProvider.java

+14 −6

Original line number	Diff line number	Diff line
		@@ -355,7 +355,8 @@ public abstract class SliceProvider extends ContentProvider {
		@Override
		public Bundle call(String method, String arg, Bundle extras) {
		if (method.equals(METHOD_SLICE)) {
		Uri uri = getUriWithoutUserId(extras.getParcelable(EXTRA_BIND_URI));
		Uri uri = getUriWithoutUserId(validateIncomingUriOrNull(
		extras.getParcelable(EXTRA_BIND_URI)));
		List<SliceSpec> supportedSpecs = extras.getParcelableArrayList(EXTRA_SUPPORTED_SPECS);

		String callingPackage = getCallingPackage();
		@@ -369,7 +370,7 @@ public abstract class SliceProvider extends ContentProvider {
		} else if (method.equals(METHOD_MAP_INTENT)) {
		Intent intent = extras.getParcelable(EXTRA_INTENT);
		if (intent == null) return null;
		Uri uri = onMapIntentToUri(intent);
		Uri uri = validateIncomingUriOrNull(onMapIntentToUri(intent));
		List<SliceSpec> supportedSpecs = extras.getParcelableArrayList(EXTRA_SUPPORTED_SPECS);
		Bundle b = new Bundle();
		if (uri != null) {
		@@ -383,24 +384,27 @@ public abstract class SliceProvider extends ContentProvider {
		} else if (method.equals(METHOD_MAP_ONLY_INTENT)) {
		Intent intent = extras.getParcelable(EXTRA_INTENT);
		if (intent == null) return null;
		Uri uri = onMapIntentToUri(intent);
		Uri uri = validateIncomingUriOrNull(onMapIntentToUri(intent));
		Bundle b = new Bundle();
		b.putParcelable(EXTRA_SLICE, uri);
		return b;
		} else if (method.equals(METHOD_PIN)) {
		Uri uri = getUriWithoutUserId(extras.getParcelable(EXTRA_BIND_URI));
		Uri uri = getUriWithoutUserId(validateIncomingUriOrNull(
		extras.getParcelable(EXTRA_BIND_URI)));
		if (Binder.getCallingUid() != Process.SYSTEM_UID) {
		throw new SecurityException("Only the system can pin/unpin slices");
		}
		handlePinSlice(uri);
		} else if (method.equals(METHOD_UNPIN)) {
		Uri uri = getUriWithoutUserId(extras.getParcelable(EXTRA_BIND_URI));
		Uri uri = getUriWithoutUserId(validateIncomingUriOrNull(
		extras.getParcelable(EXTRA_BIND_URI)));
		if (Binder.getCallingUid() != Process.SYSTEM_UID) {
		throw new SecurityException("Only the system can pin/unpin slices");
		}
		handleUnpinSlice(uri);
		} else if (method.equals(METHOD_GET_DESCENDANTS)) {
		Uri uri = getUriWithoutUserId(extras.getParcelable(EXTRA_BIND_URI));
		Uri uri = getUriWithoutUserId(
		validateIncomingUriOrNull(extras.getParcelable(EXTRA_BIND_URI)));
		Bundle b = new Bundle();
		b.putParcelableArrayList(EXTRA_SLICE_DESCENDANTS,
		new ArrayList<>(handleGetDescendants(uri)));
		@@ -416,6 +420,10 @@ public abstract class SliceProvider extends ContentProvider {
		return super.call(method, arg, extras);
		}

		private Uri validateIncomingUriOrNull(Uri uri) {
		return uri == null ? null : validateIncomingUri(uri);
		}

		private Collection<Uri> handleGetDescendants(Uri uri) {
		mCallback = "onGetSliceDescendants";
		return onGetSliceDescendants(uri);