Merge "Validate package names passed to the installer." into main (042ebd2c) · Commits · e / os / android_frameworks_base

services/core/java/com/android/server/pm/PackageInstallerService.java

+24 −5

Original line number	Diff line number	Diff line
		@@ -58,6 +58,7 @@ import android.content.pm.PackageItemInfo;
		import android.content.pm.PackageManager;
		import android.content.pm.ParceledListSlice;
		import android.content.pm.VersionedPackage;
		import android.content.pm.parsing.FrameworkParsingPackageUtils;
		import android.graphics.Bitmap;
		import android.net.Uri;
		import android.os.Binder;
		@@ -666,17 +667,22 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements

		// App package name and label length is restricted so that really long strings aren't
		// written to disk.
		if (params.appPackageName != null
		&& params.appPackageName.length() > SessionParams.MAX_PACKAGE_NAME_LENGTH) {
		if (params.appPackageName != null && !isValidPackageName(params.appPackageName)) {
		params.appPackageName = null;
		}

		params.appLabel = TextUtils.trimToSize(params.appLabel,
		PackageItemInfo.MAX_SAFE_LABEL_LENGTH);

		String requestedInstallerPackageName = (params.installerPackageName != null
		&& params.installerPackageName.length() < SessionParams.MAX_PACKAGE_NAME_LENGTH)
		? params.installerPackageName : installerPackageName;
		// Validate installer package name.
		if (params.installerPackageName != null && !isValidPackageName(
		params.installerPackageName)) {
		params.installerPackageName = null;
		}

		var requestedInstallerPackageName =
		params.installerPackageName != null ? params.installerPackageName
		: installerPackageName;

		if (PackageManagerServiceUtils.isRootOrShell(callingUid)
		\|\| PackageInstallerSession.isSystemDataLoaderInstallation(params)
		@@ -1105,6 +1111,19 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
		return Integer.parseInt(sessionId);
		}

		private static boolean isValidPackageName(@NonNull String packageName) {
		if (packageName.length() > SessionParams.MAX_PACKAGE_NAME_LENGTH) {
		return false;
		}
		// "android" is a valid package name
		var errorMessage = FrameworkParsingPackageUtils.validateName(
		packageName, /* requireSeparator= / false, / requireFilename */ true);
		if (errorMessage != null) {
		return false;
		}
		return true;
		}

		private File getTmpSessionDir(String volumeUuid) {
		return Environment.getDataAppDirectory(volumeUuid);
		}