Loading services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java +13 −1 Original line number Original line Diff line number Diff line Loading @@ -285,8 +285,20 @@ class MediaRouter2ServiceImpl { ? routeListingPreference.getLinkedItemComponentName() ? routeListingPreference.getLinkedItemComponentName() : null; : null; if (linkedItemLandingComponent != null) { if (linkedItemLandingComponent != null) { int callingUid = Binder.getCallingUid(); MediaServerUtils.enforcePackageName( MediaServerUtils.enforcePackageName( linkedItemLandingComponent.getPackageName(), Binder.getCallingUid()); linkedItemLandingComponent.getPackageName(), callingUid); if (!MediaServerUtils.isValidActivityComponentName( mContext, linkedItemLandingComponent, RouteListingPreference.ACTION_TRANSFER_MEDIA, Binder.getCallingUserHandle())) { throw new IllegalArgumentException( "Unable to resolve " + linkedItemLandingComponent + " to a valid activity for " + RouteListingPreference.ACTION_TRANSFER_MEDIA); } } } final long token = Binder.clearCallingIdentity(); final long token = Binder.clearCallingIdentity(); Loading services/core/java/com/android/server/media/MediaServerUtils.java +24 −4 Original line number Original line Diff line number Diff line Loading @@ -16,9 +16,13 @@ package com.android.server.media; package com.android.server.media; import android.annotation.NonNull; import android.content.ComponentName; import android.content.Context; import android.content.Context; import android.content.Intent; import android.content.pm.PackageManager; import android.content.pm.PackageManager; import android.content.pm.PackageManagerInternal; import android.content.pm.PackageManagerInternal; import android.content.pm.ResolveInfo; import android.os.Binder; import android.os.Binder; import android.os.Process; import android.os.Process; import android.os.UserHandle; import android.os.UserHandle; Loading @@ -27,11 +31,27 @@ import android.text.TextUtils; import com.android.server.LocalServices; import com.android.server.LocalServices; import java.io.PrintWriter; import java.io.PrintWriter; import java.util.List; /** Util class for media server. */ /* package */ class MediaServerUtils { /** /** * Util class for media server. * Returns whether the provided {@link ComponentName} and {@code action} resolve to a valid * activity for the user defined by {@code userHandle}. */ */ class MediaServerUtils { public static boolean isValidActivityComponentName( @NonNull Context context, @NonNull ComponentName componentName, @NonNull String action, @NonNull UserHandle userHandle) { Intent intent = new Intent(action); intent.setComponent(componentName); List<ResolveInfo> resolveInfos = context.getPackageManager() .queryIntentActivitiesAsUser(intent, /* flags= */ 0, userHandle); return !resolveInfos.isEmpty(); } /** /** * Throws if the given {@code packageName} does not correspond to the given {@code uid}. * Throws if the given {@code packageName} does not correspond to the given {@code uid}. Loading Loading
services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java +13 −1 Original line number Original line Diff line number Diff line Loading @@ -285,8 +285,20 @@ class MediaRouter2ServiceImpl { ? routeListingPreference.getLinkedItemComponentName() ? routeListingPreference.getLinkedItemComponentName() : null; : null; if (linkedItemLandingComponent != null) { if (linkedItemLandingComponent != null) { int callingUid = Binder.getCallingUid(); MediaServerUtils.enforcePackageName( MediaServerUtils.enforcePackageName( linkedItemLandingComponent.getPackageName(), Binder.getCallingUid()); linkedItemLandingComponent.getPackageName(), callingUid); if (!MediaServerUtils.isValidActivityComponentName( mContext, linkedItemLandingComponent, RouteListingPreference.ACTION_TRANSFER_MEDIA, Binder.getCallingUserHandle())) { throw new IllegalArgumentException( "Unable to resolve " + linkedItemLandingComponent + " to a valid activity for " + RouteListingPreference.ACTION_TRANSFER_MEDIA); } } } final long token = Binder.clearCallingIdentity(); final long token = Binder.clearCallingIdentity(); Loading
services/core/java/com/android/server/media/MediaServerUtils.java +24 −4 Original line number Original line Diff line number Diff line Loading @@ -16,9 +16,13 @@ package com.android.server.media; package com.android.server.media; import android.annotation.NonNull; import android.content.ComponentName; import android.content.Context; import android.content.Context; import android.content.Intent; import android.content.pm.PackageManager; import android.content.pm.PackageManager; import android.content.pm.PackageManagerInternal; import android.content.pm.PackageManagerInternal; import android.content.pm.ResolveInfo; import android.os.Binder; import android.os.Binder; import android.os.Process; import android.os.Process; import android.os.UserHandle; import android.os.UserHandle; Loading @@ -27,11 +31,27 @@ import android.text.TextUtils; import com.android.server.LocalServices; import com.android.server.LocalServices; import java.io.PrintWriter; import java.io.PrintWriter; import java.util.List; /** Util class for media server. */ /* package */ class MediaServerUtils { /** /** * Util class for media server. * Returns whether the provided {@link ComponentName} and {@code action} resolve to a valid * activity for the user defined by {@code userHandle}. */ */ class MediaServerUtils { public static boolean isValidActivityComponentName( @NonNull Context context, @NonNull ComponentName componentName, @NonNull String action, @NonNull UserHandle userHandle) { Intent intent = new Intent(action); intent.setComponent(componentName); List<ResolveInfo> resolveInfos = context.getPackageManager() .queryIntentActivitiesAsUser(intent, /* flags= */ 0, userHandle); return !resolveInfos.isEmpty(); } /** /** * Throws if the given {@code packageName} does not correspond to the given {@code uid}. * Throws if the given {@code packageName} does not correspond to the given {@code uid}. Loading