Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 221ea892 authored by Dianne Hackborn's avatar Dianne Hackborn
Browse files

Start restricting service calls with implicit intents. 

The bindService() and startService() calls have always had
undefined behavior when used with an implicit Intent and there
are multiple matching services.  Because of this, it is not
safe for applications to use such Intents when interacting with
services, yet the platform would merrily go about doing... something.

In KLP I want to cause this case to be invalid, resulting in
an exception thrown back to the app.  Unfortunately there are
lots of (scary) things relying on this behavior, so we can't
immediately turn it into an exception, even one qualified by the
caller's target SDK version.

In this change, we start loggin a WTF when such a call happens,
and clean up some stuff in Bluetooth that was doing this behavior.

Change-Id: I62e25d07890588d2362104e20b054aebb6c0e007
parent 33041bd9

core/java/android/app/ContextImpl.java

+24 −0
Original line number Diff line number Diff line
@@ -1444,6 +1444,14 @@ class ContextImpl extends Context { 
    @Override

    public ComponentName startServiceAsUser(Intent service, UserHandle user) {

        try {

            if (service.getComponent() == null && service.getPackage() == null) {

                if (getApplicationInfo().targetSdkVersion >= Build.VERSION_CODES.KEY_LIME_PIE) {

                    IllegalArgumentException ex = new IllegalArgumentException(

                            "Service Intent must be explicit: " + service);

                    Log.wtf(TAG, "This will become an error", ex);

                    //throw ex;

                }

            }

            service.prepareToLeaveProcess();

            ComponentName cn = ActivityManagerNative.getDefault().startService(

                mMainThread.getApplicationThread(), service,
@@ -1468,6 +1476,14 @@ class ContextImpl extends Context { 
    @Override

    public boolean stopServiceAsUser(Intent service, UserHandle user) {

        try {

            if (service.getComponent() == null && service.getPackage() == null) {

                if (getApplicationInfo().targetSdkVersion >= Build.VERSION_CODES.KEY_LIME_PIE) {

                    IllegalArgumentException ex = new IllegalArgumentException(

                            "Service Intent must be explicit: " + service);

                    Log.wtf(TAG, "This will become an error", ex);

                    //throw ex;

                }

            }

            service.prepareToLeaveProcess();

            int res = ActivityManagerNative.getDefault().stopService(

                mMainThread.getApplicationThread(), service,
@@ -1503,6 +1519,14 @@ class ContextImpl extends Context { 
        } else {

            throw new RuntimeException("Not supported in system context");

        }

        if (service.getComponent() == null && service.getPackage() == null) {

            if (getApplicationInfo().targetSdkVersion >= Build.VERSION_CODES.KEY_LIME_PIE) {

                IllegalArgumentException ex = new IllegalArgumentException(

                        "Service Intent must be explicit: " + service);

                Log.wtf(TAG, "This will become an error", ex);

                //throw ex;

            }

        }

        try {

            IBinder token = getActivityToken();

            if (token == null && (flags&BIND_AUTO_CREATE) == 0 && mPackageInfo != null

core/java/android/bluetooth/BluetoothA2dp.java

+12 −5
Original line number Diff line number Diff line
@@ -128,9 +128,7 @@ public final class BluetoothA2dp implements BluetoothProfile { 
                            try {

                                if (mService == null) {

                                    if (VDBG) Log.d(TAG,"Binding service...");

                                    if (!mContext.bindService(new Intent(IBluetoothA2dp.class.getName()), mConnection, 0)) {

                                        Log.e(TAG, "Could not bind to Bluetooth A2DP Service");

                                    }

                                    doBind();

                                }

                            } catch (Exception re) {

                                Log.e(TAG,"",re);
@@ -157,9 +155,18 @@ public final class BluetoothA2dp implements BluetoothProfile { 
            }

        }



        if (!context.bindService(new Intent(IBluetoothA2dp.class.getName()), mConnection, 0)) {

            Log.e(TAG, "Could not bind to Bluetooth A2DP Service");

        doBind();

    }



    boolean doBind() {

        Intent intent = new Intent(IBluetoothA2dp.class.getName());

        ComponentName comp = intent.resolveSystemService(mContext.getPackageManager(), 0);

        intent.setComponent(comp);

        if (comp == null || !mContext.bindService(intent, mConnection, 0)) {

            Log.e(TAG, "Could not bind to Bluetooth A2DP Service with " + intent);

            return false;

        }

        return true;

    }



    /*package*/ void close() {

core/java/android/bluetooth/BluetoothHeadset.java

+12 −5
Original line number Diff line number Diff line
@@ -241,9 +241,7 @@ public final class BluetoothHeadset implements BluetoothProfile { 
                            try {

                                if (mService == null) {

                                    if (VDBG) Log.d(TAG,"Binding service...");

                                    if (!mContext.bindService(new Intent(IBluetoothHeadset.class.getName()), mConnection, 0)) {

                                        Log.e(TAG, "Could not bind to Bluetooth Headset Service");

                                    }

                                    doBind();

                                }

                            } catch (Exception re) {

                                Log.e(TAG,"",re);
@@ -270,9 +268,18 @@ public final class BluetoothHeadset implements BluetoothProfile { 
            }

        }



        if (!context.bindService(new Intent(IBluetoothHeadset.class.getName()), mConnection, 0)) {

            Log.e(TAG, "Could not bind to Bluetooth Headset Service");

        doBind();

    }



    boolean doBind() {

        Intent intent = new Intent(IBluetoothHeadset.class.getName());

        ComponentName comp = intent.resolveSystemService(mContext.getPackageManager(), 0);

        intent.setComponent(comp);

        if (comp == null || !mContext.bindService(intent, mConnection, 0)) {

            Log.e(TAG, "Could not bind to Bluetooth Headset Service with " + intent);

            return false;

        }

        return true;

    }



    /**

core/java/android/bluetooth/BluetoothHealth.java

+12 −5
Original line number Diff line number Diff line
@@ -117,9 +117,7 @@ public final class BluetoothHealth implements BluetoothProfile { 
                            try {

                                if (mService == null) {

                                    if (VDBG) Log.d(TAG,"Binding service...");

                                    if (!mContext.bindService(new Intent(IBluetoothHealth.class.getName()), mConnection, 0)) {

                                        Log.e(TAG, "Could not bind to Bluetooth Health Service");

                                    }

                                    doBind();

                                }

                            } catch (Exception re) {

                                Log.e(TAG,"",re);
@@ -483,9 +481,18 @@ public final class BluetoothHealth implements BluetoothProfile { 
            }

        }



        if (!context.bindService(new Intent(IBluetoothHealth.class.getName()), mConnection, 0)) {

            Log.e(TAG, "Could not bind to Bluetooth Health Service");

        doBind();

    }



    boolean doBind() {

        Intent intent = new Intent(IBluetoothHealth.class.getName());

        ComponentName comp = intent.resolveSystemService(mContext.getPackageManager(), 0);

        intent.setComponent(comp);

        if (comp == null || !mContext.bindService(intent, mConnection, 0)) {

            Log.e(TAG, "Could not bind to Bluetooth Health Service with " + intent);

            return false;

        }

        return true;

    }



    /*package*/ void close() {

core/java/android/bluetooth/BluetoothInputDevice.java

+12 −6
Original line number Diff line number Diff line
@@ -206,9 +206,7 @@ public final class BluetoothInputDevice implements BluetoothProfile { 
                            try {

                                if (mService == null) {

                                    if (VDBG) Log.d(TAG,"Binding service...");

                                    if (!mContext.bindService(new Intent(IBluetoothInputDevice.class.getName()), mConnection, 0)) {

                                        Log.e(TAG, "Could not bind to Bluetooth HID Service");

                                    }

                                    doBind();

                                }

                            } catch (Exception re) {

                                Log.e(TAG,"",re);
@@ -237,10 +235,18 @@ public final class BluetoothInputDevice implements BluetoothProfile { 
            }

        }



        if (!context.bindService(new Intent(IBluetoothInputDevice.class.getName()),

                                 mConnection, 0)) {

            Log.e(TAG, "Could not bind to Bluetooth HID Service");

        doBind();

    }



    boolean doBind() {

        Intent intent = new Intent(IBluetoothInputDevice.class.getName());

        ComponentName comp = intent.resolveSystemService(mContext.getPackageManager(), 0);

        intent.setComponent(comp);

        if (comp == null || !mContext.bindService(intent, mConnection, 0)) {

            Log.e(TAG, "Could not bind to Bluetooth HID Service with " + intent);

            return false;

        }

        return true;

    }



    /*package*/ void close() {