Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5babd461 authored by Tim Yu's avatar Tim Yu Committed by Android Build Coastguard Worker
Browse files

Check permissions of URI inside of Autofill Slices 

Bug: 292104015
Test: Local poc app
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:73e2b35a63d8c5da528b7a2dad2091f40b0f49c1)
Merged-In: I25e96be5323ad408f1ba9aef5f9a80e4f00c77a2
Change-Id: I25e96be5323ad408f1ba9aef5f9a80e4f00c77a2
parent d8b9ab78

services/autofill/java/com/android/server/autofill/Helper.java

+50 −5
Original line number Diff line number Diff line
@@ -28,8 +28,11 @@ import android.app.ActivityManager; 
import android.app.assist.AssistStructure;

import android.app.assist.AssistStructure.ViewNode;

import android.app.assist.AssistStructure.WindowNode;

import android.app.slice.Slice;

import android.app.slice.SliceItem;

import android.content.ComponentName;

import android.content.Context;

import android.graphics.drawable.Icon;

import android.hardware.display.DisplayManager;

import android.metrics.LogMaker;

import android.os.UserHandle;
@@ -97,8 +100,9 @@ public final class Helper { 
            @UserIdInt int userId, @NonNull RemoteViews rView) {

        final AtomicBoolean permissionsOk = new AtomicBoolean(true);



        rView.visitUris(uri -> {

            int uriOwnerId = android.content.ContentProvider.getUserIdFromUri(uri);

        rView.visitUris(

                uri -> {

                    int uriOwnerId = android.content.ContentProvider.getUserIdFromUri(uri, userId);

                    boolean allowed = uriOwnerId == userId;

                    permissionsOk.set(allowed & permissionsOk.get());

                });
@@ -150,6 +154,47 @@ public final class Helper { 
        return (ok ? rView : null);

    }



    /**

     * Checks the URI permissions of the icon in the slice, to see if the current userId is able to

     * access it.

     *

     * <p>Returns null if slice contains user inaccessible icons

     *

     * <p>TODO: instead of returning a null Slice when the current userId cannot access an icon,

     * return a reconstructed Slice without the icons. This is currently non-trivial since there are

     * no public methods to generically add SliceItems to Slices

     */

    public static @Nullable Slice sanitizeSlice(Slice slice) {

        if (slice == null) {

            return null;

        }



        int userId = ActivityManager.getCurrentUser();



        // Recontruct the Slice, filtering out bad icons

        for (SliceItem sliceItem : slice.getItems()) {

            if (!sliceItem.getFormat().equals(SliceItem.FORMAT_IMAGE)) {

                // Not an image slice

                continue;

            }



            Icon icon = sliceItem.getIcon();

            if (icon.getType() != Icon.TYPE_URI

                    && icon.getType() != Icon.TYPE_URI_ADAPTIVE_BITMAP) {

                // No URIs to sanitize

                continue;

            }



            int iconUriId = android.content.ContentProvider.getUserIdFromUri(icon.getUri(), userId);



            if (iconUriId != userId) {

                Slog.w(TAG, "sanitizeSlice() user: " + userId + " cannot access icons in Slice");

                return null;

            }

        }



        return slice;

    }



    @Nullable

    static AutofillId[] toArray(@Nullable ArraySet<AutofillId> set) {

services/autofill/java/com/android/server/autofill/ui/RemoteInlineSuggestionViewConnector.java

+5 −0
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ import android.service.autofill.InlinePresentation; 
import android.util.Slog;



import com.android.server.LocalServices;

import com.android.server.autofill.Helper;

import com.android.server.autofill.RemoteInlineSuggestionRenderService;

import com.android.server.inputmethod.InputMethodManagerInternal;
@@ -83,6 +84,10 @@ final class RemoteInlineSuggestionViewConnector { 
     */

    public boolean renderSuggestion(int width, int height,

            @NonNull IInlineSuggestionUiCallback callback) {

        if (Helper.sanitizeSlice(mInlinePresentation.getSlice()) == null) {

            if (sDebug) Slog.d(TAG, "Skipped rendering inline suggestion.");

            return false;

        }

        if (mRemoteRenderService != null) {

            if (sDebug) Slog.d(TAG, "Request to recreate the UI");

            mRemoteRenderService.renderSuggestion(callback, mInlinePresentation, width, height,