Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0a0778e9 authored by Nan Wu's avatar Nan Wu
Browse files

Rescind BAL privilege when ShortcutService sends the callback PI 

When AppWidgetManager.requestPinAppWidget is called from a client,
The passed in callback PendingIntent is called from the system
server. This allows the PendingIntent to be able to bypass BAL
checks.

Bug: 278722815
Test: manual test. BackgroundActivityLaunchTest. Regression like
      RequestPinAppWidgetTest, PeopleSpaceWidgetManagerTest, etc.
Merged-In: I2df9de272192c9a149a9ff519c96e6e0e8304040
Change-Id: I2df9de272192c9a149a9ff519c96e6e0e8304040
(cherry picked from commit eb904695)
parent cbba85d2

services/core/java/com/android/server/pm/ShortcutService.java

+6 −1
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
 */

package com.android.server.pm;



import static android.app.ActivityOptions.MODE_BACKGROUND_ACTIVITY_START_DENIED;

import static android.provider.DeviceConfig.NAMESPACE_SYSTEMUI;



import android.Manifest.permission;
@@ -24,6 +25,7 @@ import android.annotation.Nullable; 
import android.annotation.UserIdInt;

import android.app.ActivityManager;

import android.app.ActivityManagerInternal;

import android.app.ActivityOptions;

import android.app.AppGlobals;

import android.app.IUidObserver;

import android.app.IUriGrantsManager;
@@ -4407,8 +4409,11 @@ public class ShortcutService extends IShortcutService.Stub { 
            return;

        }

        try {

            ActivityOptions options = ActivityOptions.makeBasic()

                    .setPendingIntentBackgroundActivityStartMode(

                            MODE_BACKGROUND_ACTIVITY_START_DENIED);

            intentSender.sendIntent(mContext, /* code= */ 0, extras,

                    /* onFinished=*/ null, /* handler= */ null);

                    /* onFinished=*/ null, /* handler= */ null, null, options.toBundle());

        } catch (SendIntentException e) {

            Slog.w(TAG, "sendIntent failed().", e);

        }