Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 54e57bbb authored by Louis Chang's avatar Louis Chang Committed by Android Build Coastguard Worker
Browse files

Do not send new Intent to non-exported activity when navigateUpTo 

The new Intent was delivered to a non-exported activity while
#navigateUpTo was called from an Activity of a different uid.

Bug: 238605611
Test: atest StartActivityTests
Change-Id: I854dd825bfd9a2c08851980d480d1f3a177af6cf
Merged-In: I854dd825bfd9a2c08851980d480d1f3a177af6cf
(cherry picked from commit 4c355690)
Merged-In: I854dd825bfd9a2c08851980d480d1f3a177af6cf
parent 76769dc1

services/core/java/com/android/server/wm/Task.java

+17 −1
Original line number Original line Diff line number Diff line
@@ -5457,7 +5457,23 @@ class Task extends TaskFragment { 
                    parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TASK ||

                    parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TASK ||

                    parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TOP ||

                    parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TOP ||

                    (destIntentFlags & Intent.FLAG_ACTIVITY_CLEAR_TOP) != 0) {

                    (destIntentFlags & Intent.FLAG_ACTIVITY_CLEAR_TOP) != 0) {

                parent.deliverNewIntentLocked(callingUid, destIntent, destGrants, srec.packageName);

                boolean abort;

                try {

                    abort = !mTaskSupervisor.checkStartAnyActivityPermission(destIntent,

                            parent.info, null /* resultWho */, -1 /* requestCode */, srec.getPid(),

                            callingUid, srec.info.packageName, null /* callingFeatureId */,

                            false /* ignoreTargetSecurity */, false /* launchingInTask */, srec.app,

                            null /* resultRecord */, null /* resultRootTask */);

                } catch (SecurityException e) {

                    abort = true;

                }

                if (abort) {

                    android.util.EventLog.writeEvent(0x534e4554, "238605611", callingUid, "");

                    foundParentInTask = false;

                } else {

                    parent.deliverNewIntentLocked(callingUid, destIntent, destGrants,

                            srec.packageName);

                }

            } else {

            } else {

                try {

                try {

                    ActivityInfo aInfo = AppGlobals.getPackageManager().getActivityInfo(

                    ActivityInfo aInfo = AppGlobals.getPackageManager().getActivityInfo(