Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ff509da authored by sallyyuen's avatar sallyyuen
Browse files

Clear caller identity in register/unregisterA11yDisplayProxy 

This fixes a bug where disabling the input filters will cause a
message to be posted by a bad caller (the app registering the proxy).

Bug: 268088816
Test: manual check that exception is now thrown, atest
 AccessibilityDisplayProxyTest
Change-Id: I048d934d7e5a0882d67765681e6ddf99a54505df
parent a3f76ef2

services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java

+17 −7
Original line number Diff line number Diff line
@@ -3807,6 +3807,8 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub 
                    + "proxy-ed");

        }



        final long identity = Binder.clearCallingIdentity();

        try {

            mProxyManager.registerProxy(client, displayId, mContext,

                    sIdCounter++, mMainHandler, mSecurityPolicy, this, getTraceManager(),

                    mWindowManagerService, mA11yWindowManager);
@@ -3814,13 +3816,21 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub 
            synchronized (mLock) {

                notifyClearAccessibilityCacheLocked();

            }

        } finally {

            Binder.restoreCallingIdentity(identity);

        }

        return true;

    }



    @Override

    public boolean unregisterProxyForDisplay(int displayId) throws RemoteException {

    public boolean unregisterProxyForDisplay(int displayId) {

        mSecurityPolicy.enforceCallingOrSelfPermission(Manifest.permission.MANAGE_ACCESSIBILITY);

        final long identity = Binder.clearCallingIdentity();

        try {

            return mProxyManager.unregisterProxy(displayId);

        } finally {

            Binder.restoreCallingIdentity(identity);

        }

    }



    boolean isDisplayProxyed(int displayId) {