Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2945b46d authored by Daniel Norman's avatar Daniel Norman
Browse files

Stop non-tool A11yServices from injecting gestures onto sensitive views. 

Sensitive views should continue responding to gestures injected by
Accessibility Tools.

Bug: 284180538
Flag: android.view.accessibility.prevent_a11y_nontool_from_injecting_into_sensitive_views
Test: atest AccessibilityEndToEndTest (CTS)
Test: atest MotionEventInjectorTest
Test: atest AccessibilityServiceConnectionTest
Test: Manual: Create a test service with isAccessibilityTool=true;
              dispatch a swipe gesture on the Settings >
	      Security & Privacy page; observe swipe is successful.
	      Repeat the above with isAccessibilityTool=false;
	      observe swipe is ignored.
Change-Id: I4298bb86062e25fa6c9e7f077a3016991d8cb91a
parent 28cef9b7

core/java/android/view/MotionEvent.java

+36 −2
Original line number Diff line number Diff line
@@ -532,13 +532,29 @@ public final class MotionEvent extends InputEvent implements Parcelable { 
    public static final int FLAG_NO_FOCUS_CHANGE = MotionEventFlag.NO_FOCUS_CHANGE;



    /**

     * This flag indicates that this event was modified by or generated from an accessibility

     * service. Value = 0x800

     * This flag indicates that this event was injected from some

     * {@link android.accessibilityservice.AccessibilityService}, which may be either an

     * Accessibility Tool OR a service using that API for purposes other than assisting users with

     * disabilities. Value = 0x800

     * @see #FLAG_INJECTED_FROM_ACCESSIBILITY_TOOL

     * @hide

     */

    @TestApi

    public static final int FLAG_IS_ACCESSIBILITY_EVENT = MotionEventFlag.IS_ACCESSIBILITY_EVENT;



    /**

     * This flag indicates that this event was injected from an

     * {@link android.accessibilityservice.AccessibilityService} with the

     * {@link android.accessibilityservice.AccessibilityServiceInfo#isAccessibilityTool()} property

     * set to true. These services (known as "Accessibility Tools") are used to assist users with

     * disabilities, so events from these services should be able to reach all Views including

     * Views which set {@link View#isAccessibilityDataSensitive()} to true.

     * Value = 0x1000

     * @hide

     */

    public static final int FLAG_INJECTED_FROM_ACCESSIBILITY_TOOL =

            MotionEventFlag.INJECTED_FROM_ACCESSIBILITY_TOOL;



    /**

     * Private flag that indicates when the system has detected that this motion event

     * may be inconsistent with respect to the sequence of previously delivered motion events,
@@ -2534,6 +2550,24 @@ public final class MotionEvent extends InputEvent implements Parcelable { 
                : flags & ~FLAG_TARGET_ACCESSIBILITY_FOCUS);

    }



    /**

     * @see #FLAG_IS_ACCESSIBILITY_EVENT

     * @hide

     */

    public boolean isInjectedFromAccessibilityService() {

        final int flags = getFlags();

        return (flags & FLAG_IS_ACCESSIBILITY_EVENT) != 0;

    }



    /**

     * @see #FLAG_INJECTED_FROM_ACCESSIBILITY_TOOL

     * @hide

     */

    public boolean isInjectedFromAccessibilityTool() {

        final int flags = getFlags();

        return (flags & FLAG_INJECTED_FROM_ACCESSIBILITY_TOOL) != 0;

    }



    /** @hide */

    public final boolean isHoverExitPending() {

        final int flags = getFlags();

core/java/android/view/View.java

+10 −0
Original line number Diff line number Diff line
@@ -16654,6 +16654,16 @@ public class View implements Drawable.Callback, KeyEvent.Callback, 
            // Window is obscured, drop this touch.

            return false;

        }

        if (android.view.accessibility.Flags.preventA11yNontoolFromInjectingIntoSensitiveViews()) {

            if (event.isInjectedFromAccessibilityService()

                    // If the event came from an Accessibility Service that does *not* declare

                    // itself as AccessibilityServiceInfo#isAccessibilityTool and this View is

                    // declared sensitive then drop the event.

                    // Only Accessibility Tools are allowed to interact with sensitive Views.

                    && !event.isInjectedFromAccessibilityTool() && isAccessibilityDataSensitive()) {

                return false;

            }

        }

        return true;

    }

























core/java/android/view/WindowManagerPolicyConstants.java



+2
−0




























Original line number
Diff line number
Diff line








@@ -17,6 +17,7 @@













package android.view;































import static android.os.IInputConstants.POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY;













import static android.os.IInputConstants.POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY_TOOL;















import static android.os.IInputConstants.POLICY_FLAG_KEY_GESTURE_TRIGGERED;































import android.annotation.IntDef;









@@ -37,6 +38,7 @@ public interface WindowManagerPolicyConstants {













    int FLAG_VIRTUAL = 0x00000002;































    int FLAG_INJECTED_FROM_ACCESSIBILITY = POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY;













    int FLAG_INJECTED_FROM_ACCESSIBILITY_TOOL = POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY_TOOL;















    int FLAG_KEY_GESTURE_TRIGGERED = POLICY_FLAG_KEY_GESTURE_TRIGGERED;















    int FLAG_INJECTED = 0x01000000;















    int FLAG_TRUSTED = 0x02000000;

































core/java/android/view/accessibility/flags/accessibility_flags.aconfig



+82
−72




























Original line number
Diff line number
Diff line








@@ -3,6 +3,14 @@ container: "system"





























# NOTE: Keep alphabetized to help limit merge conflicts from multiple simultaneous editors.





























flag {













    name: "a11y_character_in_window_api"













    namespace: "accessibility"













    description: "Enables new extra data key for an AccessibilityService to request character bounds in unmagnified window coordinates."













    bug: "375429616"













    is_exported: true













}





























flag {















    name: "a11y_expansion_state_api"















    namespace: "accessibility"










@@ -42,23 +50,15 @@ flag {













}































flag {













    name: "a11y_character_in_window_api"













    namespace: "accessibility"













    description: "Enables new extra data key for an AccessibilityService to request character bounds in unmagnified window coordinates."













    bug: "375429616"













    is_exported: true













}



























flag {













    namespace: "accessibility"















    name: "allow_shortcut_chooser_on_lockscreen"













    namespace: "accessibility"















    description: "Allows the a11y shortcut disambig dialog to appear on the lockscreen"















    bug: "303871725"















}































flag {













    namespace: "accessibility"















    name: "braille_display_hid"













    namespace: "accessibility"















    is_exported: true















    description: "Enables new APIs for an AccessibilityService to communicate with a HID Braille display"















    bug: "303522222"









@@ -72,47 +72,62 @@ flag {













}































flag {













    namespace: "accessibility"















    name: "collection_info_item_counts"













    namespace: "accessibility"















    is_exported: true















    description: "Fields for total items and the number of important for accessibility items in a collection"















    bug: "302376158"















}































flag {













    namespace: "accessibility"















    name: "copy_events_for_gesture_detection"













    namespace: "accessibility"















    description: "Creates copies of MotionEvents and GestureEvents in GestureMatcher"















    bug: "280130713"















}































flag {













    namespace: "accessibility"















    name: "deprecate_accessibility_announcement_apis"













    namespace: "accessibility"















    description: "Controls the deprecation of platform APIs related to disruptive accessibility announcements"















    bug: "376727542"















    is_exported: true















}































flag {













    namespace: "accessibility"















    name: "deprecate_ani_label_for_apis"













    namespace: "accessibility"















    description: "Controls the deprecation of AccessibilityNodeInfo labelFor apis"















    bug: "333783827"















    is_exported: true















}































flag {













    name: "enable_system_pinch_zoom_gesture"















    namespace: "accessibility"













    description: "Feature flag for system pinch zoom gesture detector and related opt-out apis"













    bug: "283323770"













}



























flag {













    name: "enable_type_window_control"













    namespace: "accessibility"













    is_exported: true













    description: "adds new TYPE_WINDOW_CONTROL to AccessibilityWindowInfo for detecting Window Decorations"













    bug: "320445550"













}



























flag {















    name: "flash_notification_system_api"













    namespace: "accessibility"















    is_exported: true















    description: "Makes flash notification APIs as system APIs for calling from mainline module"















    bug: "303131332"















}































flag {













    namespace: "accessibility"















    name: "focus_rect_min_size"













    namespace: "accessibility"















    description: "Ensures the a11y focus rect is big enough to be drawn as visible"















    bug: "368667566"















    metadata {









@@ -121,102 +136,101 @@ flag {













}































flag {













    namespace: "accessibility"















    name: "force_invert_color"













    namespace: "accessibility"















    description: "Enable force force-dark for smart inversion and dark theme everywhere"















    bug: "282821643"















}































flag {













    name: "migrate_enable_shortcuts"













    name: "global_action_media_play_pause"















    namespace: "accessibility"













    description: "Refactors deprecated code to use AccessibilityManager#enableShortcutsForTargets."













    bug: "332006721"













    metadata {













        purpose: PURPOSE_BUGFIX













    }













}



























flag {













    name: "motion_event_observing"













    description: "Allow AccessibilityService to perform GLOBAL_ACTION_MEDIA_PLAY_PAUSE"













    bug: "334954140"















    is_exported: true













    namespace: "accessibility"













    description: "Allows accessibility services to intercept but not consume motion events from specified sources."













    bug: "297595990"















}































flag {













    namespace: "accessibility"















    name: "global_action_menu"













    namespace: "accessibility"















    description: "Allow AccessibilityService to perform GLOBAL_ACTION_MENU"















    bug: "334954140"















    is_exported: true















}































flag {













    name: "granular_scrolling"















    namespace: "accessibility"













    name: "global_action_media_play_pause"













    description: "Allow AccessibilityService to perform GLOBAL_ACTION_MEDIA_PLAY_PAUSE"













    bug: "334954140"















    is_exported: true













    description: "Allow the use of granular scrolling. This allows scrollable nodes to scroll by increments other than a full screen"













    bug: "302376158"















}































flag {













    name: "indeterminate_range_info"















    namespace: "accessibility"













    name: "granular_scrolling"













    description: "Creates a way to create an INDETERMINATE RangeInfo"













    bug: "376108874"















    is_exported: true













    description: "Allow the use of granular scrolling. This allows scrollable nodes to scroll by increments other than a full screen"













    bug: "302376158"















}































flag {













    name: "migrate_enable_shortcuts"















    namespace: "accessibility"













    name: "reduce_window_content_changed_event_throttle"













    description: "Reduces the throttle of AccessibilityEvent of TYPE_WINDOW_CONTENT_CHANGED"













    bug: "277305460"













    description: "Refactors deprecated code to use AccessibilityManager#enableShortcutsForTargets."













    bug: "332006721"













    metadata {













        purpose: PURPOSE_BUGFIX













    }















}































flag {













    name: "motion_event_observing"













    is_exported: true















    namespace: "accessibility"













    name: "remove_child_hover_check_for_touch_exploration"













    description: "Remove a check for a hovered child that prevents touch events from being delegated to non-direct descendants"













    bug: "304770837"













    description: "Allows accessibility services to intercept but not consume motion events from specified sources."













    bug: "297595990"















}































flag {













    name: "skip_accessibility_warning_dialog_for_trusted_services"













    name: "prevent_a11y_nontool_from_injecting_into_sensitive_views"















    namespace: "accessibility"













    description: "Skips showing the accessibility warning dialog for trusted services."













    bug: "303511250"













    description: "Prevents injected gestures from A11yServices without isAccessibilityTool=true from reaching AccessibilityDataSensitive UI elements"













    bug: "284180538"













    metadata {













        purpose: PURPOSE_BUGFIX













    }















}































flag {













    name: "prevent_leaking_viewrootimpl"















    namespace: "accessibility"













    name: "enable_type_window_control"













    is_exported: true













    description: "adds new TYPE_WINDOW_CONTROL to AccessibilityWindowInfo for detecting Window Decorations"













    bug: "320445550"













    description: "Clear pending messages and callbacks of the handler in AccessibilityInteractionController when the ViewRootImpl is detached from Window to prevent leaking ViewRootImpl"













    bug: "320701910"













    metadata {













        purpose: PURPOSE_BUGFIX













    }















}































flag {













    name: "reduce_window_content_changed_event_throttle"















    namespace: "accessibility"













    name: "update_always_on_a11y_service"













    description: "Updates the Always-On A11yService state when the user changes the enablement of the shortcut."













    bug: "298869916"













    description: "Reduces the throttle of AccessibilityEvent of TYPE_WINDOW_CONTENT_CHANGED"













    bug: "277305460"















}































flag {













    name: "enable_system_pinch_zoom_gesture"













    name: "remove_child_hover_check_for_touch_exploration"















    namespace: "accessibility"













    description: "Feature flag for system pinch zoom gesture detector and related opt-out apis"













    bug: "283323770"













    description: "Remove a check for a hovered child that prevents touch events from being delegated to non-direct descendants"













    bug: "304770837"















}































flag {













    name: "prevent_leaking_viewrootimpl"













    name: "restore_a11y_secure_settings_on_hsum_device"















    namespace: "accessibility"













    description: "Clear pending messages and callbacks of the handler in AccessibilityInteractionController when the ViewRootImpl is detached from Window to prevent leaking ViewRootImpl"













    bug: "320701910"













    description: "Grab the a11y settings and send the settings restored broadcast for current visible foreground user"













    bug: "381294327"















    metadata {















        purpose: PURPOSE_BUGFIX















    }









@@ -233,13 +247,10 @@ flag {













}































flag {













    name: "restore_a11y_secure_settings_on_hsum_device"













    name: "skip_accessibility_warning_dialog_for_trusted_services"















    namespace: "accessibility"













    description: "Grab the a11y settings and send the settings restored broadcast for current visible foreground user"













    bug: "381294327"













    metadata {













        purpose: PURPOSE_BUGFIX













    }













    description: "Skips showing the accessibility warning dialog for trusted services."













    bug: "303511250"















}































flag {










@@ -273,6 +284,13 @@ flag {













    is_exported: true















}





























flag {













    namespace: "accessibility"













    name: "update_always_on_a11y_service"













    description: "Updates the Always-On A11yService state when the user changes the enablement of the shortcut."













    bug: "298869916"













}





























flag {















    name: "warning_use_default_dialog_type"















    namespace: "accessibility"









@@ -282,11 +300,3 @@ flag {













        purpose: PURPOSE_BUGFIX















    }















}


























flag {













    name: "indeterminate_range_info"













    namespace: "accessibility"













    description: "Creates a way to create an INDETERMINATE RangeInfo"













    bug: "376108874"













    is_exported: true













}
























services/accessibility/java/com/android/server/accessibility/AccessibilityInputFilter.java



+3
−2




























Original line number
Diff line number
Diff line








@@ -33,6 +33,7 @@ import android.os.Looper;













import android.os.PowerManager;















import android.os.SystemClock;















import android.provider.Settings;













import android.util.Log;















import android.util.Slog;















import android.util.SparseArray;















import android.util.SparseBooleanArray;










@@ -74,9 +75,9 @@ import java.util.StringJoiner;













 */















class AccessibilityInputFilter extends InputFilter implements EventStreamTransformation {





























    private static final String TAG = AccessibilityInputFilter.class.getSimpleName();













    private static final String TAG = "A11yInputFilter";





























    private static final boolean DEBUG = false;













    private static final boolean DEBUG = Log.isLoggable(TAG, Log.DEBUG);































    /**















     * Flag for enabling the screen magnification feature.