Loading services/core/java/com/android/server/accounts/AccountManagerService.java +10 −0 Original line number Diff line number Diff line Loading @@ -183,6 +183,7 @@ public class AccountManagerService final MessageHandler mHandler; private static final int TIMEOUT_DELAY_MS = 1000 * 60 * 15; // Messages that can be sent on mHandler private static final int MESSAGE_TIMED_OUT = 3; private static final int MESSAGE_COPY_SHARED_ACCOUNT = 4; Loading Loading @@ -4839,6 +4840,7 @@ public class AccountManagerService synchronized (mSessions) { mSessions.put(toString(), this); } scheduleTimeout(); if (response != null) { try { response.asBinder().linkToDeath(this, 0 /* flags */); Loading Loading @@ -5005,6 +5007,11 @@ public class AccountManagerService } } private void scheduleTimeout() { mHandler.sendMessageDelayed( mHandler.obtainMessage(MESSAGE_TIMED_OUT, this), TIMEOUT_DELAY_MS); } public void cancelTimeout() { mHandler.removeMessages(MESSAGE_TIMED_OUT, this); } Loading Loading @@ -5041,6 +5048,9 @@ public class AccountManagerService public void onTimedOut() { IAccountManagerResponse response = getResponseAndClose(); if (Log.isLoggable(TAG, Log.VERBOSE)) { Log.v(TAG, "Session.onTimedOut"); } if (response != null) { try { response.onError(AccountManager.ERROR_CODE_REMOTE_EXCEPTION, Loading services/core/java/com/android/server/pm/PackageInstallerService.java +24 −5 Original line number Diff line number Diff line Loading @@ -47,6 +47,7 @@ import android.content.pm.PackageItemInfo; import android.content.pm.PackageManager; import android.content.pm.ParceledListSlice; import android.content.pm.VersionedPackage; import android.content.pm.parsing.ParsingPackageUtils; import android.graphics.Bitmap; import android.net.Uri; import android.os.Binder; Loading Loading @@ -601,17 +602,22 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements // App package name and label length is restricted so that really long strings aren't // written to disk. if (params.appPackageName != null && params.appPackageName.length() > SessionParams.MAX_PACKAGE_NAME_LENGTH) { if (params.appPackageName != null && !isValidPackageName(params.appPackageName)) { params.appPackageName = null; } params.appLabel = TextUtils.trimToSize(params.appLabel, PackageItemInfo.MAX_SAFE_LABEL_LENGTH); String requestedInstallerPackageName = (params.installerPackageName != null && params.installerPackageName.length() < SessionParams.MAX_PACKAGE_NAME_LENGTH) ? params.installerPackageName : installerPackageName; // Validate installer package name. if (params.installerPackageName != null && !isValidPackageName( params.installerPackageName)) { params.installerPackageName = null; } String requestedInstallerPackageName = params.installerPackageName != null ? params.installerPackageName : installerPackageName; if ((callingUid == Process.SHELL_UID) || (callingUid == Process.ROOT_UID)) { params.installFlags |= PackageManager.INSTALL_FROM_ADB; Loading Loading @@ -935,6 +941,19 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements throw new IllegalStateException("Failed to allocate session ID"); } private static boolean isValidPackageName(@NonNull String packageName) { if (packageName.length() > SessionParams.MAX_PACKAGE_NAME_LENGTH) { return false; } // "android" is a valid package name String errorMessage = ParsingPackageUtils.validateName( packageName, /* requireSeparator= */ false, /* requireFilename */ true); if (errorMessage != null) { return false; } return true; } private File getTmpSessionDir(String volumeUuid) { return Environment.getDataAppDirectory(volumeUuid); } Loading services/core/java/com/android/server/pm/PackageManagerService.java +3 −0 Original line number Diff line number Diff line Loading @@ -16454,6 +16454,9 @@ public class PackageManagerService extends IPackageManager.Stub if (pkgSetting == null) { return PackageManager.INSTALL_FAILED_INVALID_URI; } if (instantApp && (pkgSetting.isSystem() || isUpdatedSystemApp(pkgSetting))) { return PackageManager.INSTALL_FAILED_INVALID_URI; } if (!canViewInstantApps(callingUid, UserHandle.getUserId(callingUid))) { // only allow the existing package to be used if it's installed as a full // application for at least one user services/print/java/com/android/server/print/PrintManagerService.java +34 −1 Original line number Diff line number Diff line Loading @@ -254,12 +254,45 @@ public final class PrintManagerService extends SystemService { } final long identity = Binder.clearCallingIdentity(); try { return userState.getCustomPrinterIcon(printerId); Icon icon = userState.getCustomPrinterIcon(printerId); return validateIconUserBoundary(icon); } finally { Binder.restoreCallingIdentity(identity); } } /** * Validates the custom printer icon to see if it's not in the calling user space. * If the condition is not met, return null. Otherwise, return the original icon. * * @param icon * @return icon (validated) */ private Icon validateIconUserBoundary(Icon icon) { // Refer to Icon#getUriString for context. The URI string is invalid for icons of // incompatible types. if (icon != null && (icon.getType() == Icon.TYPE_URI || icon.getType() == Icon.TYPE_URI_ADAPTIVE_BITMAP)) { String encodedUser = icon.getUri().getEncodedUserInfo(); // If there is no encoded user, the URI is calling into the calling user space if (encodedUser != null) { int userId = Integer.parseInt(encodedUser); // resolve encoded user final int resolvedUserId = resolveCallingUserEnforcingPermissions(userId); synchronized (mLock) { // Only the current group members can get the printer icons. if (resolveCallingProfileParentLocked(resolvedUserId) != getCurrentUserId()) { return null; } } } } return icon; } @Override public void cancelPrintJob(PrintJobId printJobId, int appId, int userId) { if (printJobId == null) { Loading Loading
services/core/java/com/android/server/accounts/AccountManagerService.java +10 −0 Original line number Diff line number Diff line Loading @@ -183,6 +183,7 @@ public class AccountManagerService final MessageHandler mHandler; private static final int TIMEOUT_DELAY_MS = 1000 * 60 * 15; // Messages that can be sent on mHandler private static final int MESSAGE_TIMED_OUT = 3; private static final int MESSAGE_COPY_SHARED_ACCOUNT = 4; Loading Loading @@ -4839,6 +4840,7 @@ public class AccountManagerService synchronized (mSessions) { mSessions.put(toString(), this); } scheduleTimeout(); if (response != null) { try { response.asBinder().linkToDeath(this, 0 /* flags */); Loading Loading @@ -5005,6 +5007,11 @@ public class AccountManagerService } } private void scheduleTimeout() { mHandler.sendMessageDelayed( mHandler.obtainMessage(MESSAGE_TIMED_OUT, this), TIMEOUT_DELAY_MS); } public void cancelTimeout() { mHandler.removeMessages(MESSAGE_TIMED_OUT, this); } Loading Loading @@ -5041,6 +5048,9 @@ public class AccountManagerService public void onTimedOut() { IAccountManagerResponse response = getResponseAndClose(); if (Log.isLoggable(TAG, Log.VERBOSE)) { Log.v(TAG, "Session.onTimedOut"); } if (response != null) { try { response.onError(AccountManager.ERROR_CODE_REMOTE_EXCEPTION, Loading
services/core/java/com/android/server/pm/PackageInstallerService.java +24 −5 Original line number Diff line number Diff line Loading @@ -47,6 +47,7 @@ import android.content.pm.PackageItemInfo; import android.content.pm.PackageManager; import android.content.pm.ParceledListSlice; import android.content.pm.VersionedPackage; import android.content.pm.parsing.ParsingPackageUtils; import android.graphics.Bitmap; import android.net.Uri; import android.os.Binder; Loading Loading @@ -601,17 +602,22 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements // App package name and label length is restricted so that really long strings aren't // written to disk. if (params.appPackageName != null && params.appPackageName.length() > SessionParams.MAX_PACKAGE_NAME_LENGTH) { if (params.appPackageName != null && !isValidPackageName(params.appPackageName)) { params.appPackageName = null; } params.appLabel = TextUtils.trimToSize(params.appLabel, PackageItemInfo.MAX_SAFE_LABEL_LENGTH); String requestedInstallerPackageName = (params.installerPackageName != null && params.installerPackageName.length() < SessionParams.MAX_PACKAGE_NAME_LENGTH) ? params.installerPackageName : installerPackageName; // Validate installer package name. if (params.installerPackageName != null && !isValidPackageName( params.installerPackageName)) { params.installerPackageName = null; } String requestedInstallerPackageName = params.installerPackageName != null ? params.installerPackageName : installerPackageName; if ((callingUid == Process.SHELL_UID) || (callingUid == Process.ROOT_UID)) { params.installFlags |= PackageManager.INSTALL_FROM_ADB; Loading Loading @@ -935,6 +941,19 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements throw new IllegalStateException("Failed to allocate session ID"); } private static boolean isValidPackageName(@NonNull String packageName) { if (packageName.length() > SessionParams.MAX_PACKAGE_NAME_LENGTH) { return false; } // "android" is a valid package name String errorMessage = ParsingPackageUtils.validateName( packageName, /* requireSeparator= */ false, /* requireFilename */ true); if (errorMessage != null) { return false; } return true; } private File getTmpSessionDir(String volumeUuid) { return Environment.getDataAppDirectory(volumeUuid); } Loading
services/core/java/com/android/server/pm/PackageManagerService.java +3 −0 Original line number Diff line number Diff line Loading @@ -16454,6 +16454,9 @@ public class PackageManagerService extends IPackageManager.Stub if (pkgSetting == null) { return PackageManager.INSTALL_FAILED_INVALID_URI; } if (instantApp && (pkgSetting.isSystem() || isUpdatedSystemApp(pkgSetting))) { return PackageManager.INSTALL_FAILED_INVALID_URI; } if (!canViewInstantApps(callingUid, UserHandle.getUserId(callingUid))) { // only allow the existing package to be used if it's installed as a full // application for at least one user
services/print/java/com/android/server/print/PrintManagerService.java +34 −1 Original line number Diff line number Diff line Loading @@ -254,12 +254,45 @@ public final class PrintManagerService extends SystemService { } final long identity = Binder.clearCallingIdentity(); try { return userState.getCustomPrinterIcon(printerId); Icon icon = userState.getCustomPrinterIcon(printerId); return validateIconUserBoundary(icon); } finally { Binder.restoreCallingIdentity(identity); } } /** * Validates the custom printer icon to see if it's not in the calling user space. * If the condition is not met, return null. Otherwise, return the original icon. * * @param icon * @return icon (validated) */ private Icon validateIconUserBoundary(Icon icon) { // Refer to Icon#getUriString for context. The URI string is invalid for icons of // incompatible types. if (icon != null && (icon.getType() == Icon.TYPE_URI || icon.getType() == Icon.TYPE_URI_ADAPTIVE_BITMAP)) { String encodedUser = icon.getUri().getEncodedUserInfo(); // If there is no encoded user, the URI is calling into the calling user space if (encodedUser != null) { int userId = Integer.parseInt(encodedUser); // resolve encoded user final int resolvedUserId = resolveCallingUserEnforcingPermissions(userId); synchronized (mLock) { // Only the current group members can get the printer icons. if (resolveCallingProfileParentLocked(resolvedUserId) != getCurrentUserId()) { return null; } } } } return icon; } @Override public void cancelPrintJob(PrintJobId printJobId, int appId, int userId) { if (printJobId == null) { Loading