Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3228124a authored by Sihua Ma's avatar Sihua Ma
Browse files

Enforce same package name when connecting to widget service 

Bug: 361181621
Flag: android.appwidget.flags.remote_adapter_conversion
Test: Manually verified
Change-Id: I0aac4877638136291d8c7053632d60f1bcccd280
parent 152b4dd2

core/java/android/widget/RemoteViews.java

+10 −0
Original line number Diff line number Diff line
@@ -1559,6 +1559,16 @@ public class RemoteViews implements Parcelable, Filter { 
            final Context context = ActivityThread.currentApplication();



            final CompletableFuture<RemoteCollectionItems> result = new CompletableFuture<>();

            String contextPackageName = context.getPackageName();

            ComponentName intentComponent = intent.getComponent();

            if (contextPackageName != null

                    && intentComponent != null

                    && (!contextPackageName.equals(intentComponent.getPackageName()))) {

                // We shouldn't allow for connections to other packages

                result.complete(new RemoteCollectionItems.Builder().build());

                return result;

            }



            context.bindService(intent, Context.BindServiceFlags.of(Context.BIND_AUTO_CREATE),

                    result.defaultExecutor(), new ServiceConnection() {

                        @Override