Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f24cbe9 authored by Iván Budnik's avatar Iván Budnik
Browse files

Bypass app package visibility for package name check 

With this change, MediaRouter2 will validate package name against the
full list of installed packages, rather than the app's restricted
package list. This will avoid MediaRouter2 failing to validate existing
package names.

Test: atest CtsMediaBetterTogetherTestCases MediaRouter2HostSideTest
Bug: 260870618
Bug: 238178508
Change-Id: I38031e98228b3783889a5eeefd7478ec22663516
parent b4de8520

media/java/android/media/IMediaRouterService.aidl

+1 −0
Original line number Diff line number Diff line
@@ -50,6 +50,7 @@ interface IMediaRouterService { 
    // MediaRouterService.java for readability.



    // Methods for MediaRouter2

    boolean verifyPackageName(String clientPackageName);

    void enforceMediaContentControlPermission();

    List<MediaRoute2Info> getSystemRoutes();

    RoutingSessionInfo getSystemSessionInfo();

media/java/android/media/MediaRouter2.java

+4 −9
Original line number Diff line number Diff line
@@ -26,7 +26,6 @@ import android.annotation.RequiresPermission; 
import android.annotation.SystemApi;

import android.annotation.TestApi;

import android.content.Context;

import android.content.pm.PackageManager;

import android.os.Bundle;

import android.os.Handler;

import android.os.Looper;
@@ -211,17 +210,13 @@ public final class MediaRouter2 { 
        try {

            // SecurityException will be thrown if there's no permission.

            serviceBinder.enforceMediaContentControlPermission();

        } catch (RemoteException e) {

            e.rethrowFromSystemServer();

        }



        PackageManager pm = context.getPackageManager();

        try {

            pm.getPackageInfo(clientPackageName, 0);

        } catch (PackageManager.NameNotFoundException ex) {

            if (!serviceBinder.verifyPackageName(clientPackageName)) {

                Log.e(TAG, "Package " + clientPackageName + " not found. Ignoring.");

                return null;

            }

        } catch (RemoteException e) {

            e.rethrowFromSystemServer();

        }



        synchronized (sSystemRouterLock) {

            MediaRouter2 instance = sSystemMediaRouter2Map.get(clientPackageName);

services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java

+15 −0
Original line number Diff line number Diff line
@@ -152,6 +152,21 @@ class MediaRouter2ServiceImpl { 


    // Start of methods that implement MediaRouter2 operations.



    @NonNull

    public boolean verifyPackageName(@NonNull String clientPackageName) {

        final long token = Binder.clearCallingIdentity();



        try {

            PackageManager pm = mContext.getPackageManager();

            pm.getPackageInfo(clientPackageName, PackageManager.PackageInfoFlags.of(0));

            return true;

        } catch (PackageManager.NameNotFoundException ex) {

            return false;

        } finally {

            Binder.restoreCallingIdentity(token);

        }

    }



    @NonNull

    public void enforceMediaContentControlPermission() {

        final int pid = Binder.getCallingPid();

services/core/java/com/android/server/media/MediaRouterService.java

+6 −0
Original line number Diff line number Diff line
@@ -378,6 +378,12 @@ public final class MediaRouterService extends IMediaRouterService.Stub 
        mService2.dump(pw, "");

    }



    // Binder call

    @Override

    public boolean verifyPackageName(String clientPackageName) {

        return mService2.verifyPackageName(clientPackageName);

    }



    // Binder call

    @Override

    public void enforceMediaContentControlPermission() {