Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6110caff authored by John Wu's avatar John Wu
Browse files

Proper PendingIntent.queryIntentComponents implementation 

PendingIntent.queryIntentComponents currently does not take the pending
intent creator UID into account when performing component resolution.
This will return incorrect results, since explicit intents with
non-matching intent filter can only be resolved if the sender is the
same UID as the target component.

Bug: 238415222
Test: atest CtsContentTestCases:PackageManagerTest
Change-Id: Ib4e1c04c8de4e9bcee35d584dfb213954ec65449
parent 4760b7cd

services/core/java/com/android/server/am/ActivityManagerService.java

+10 −7
Original line number Original line Diff line number Diff line
@@ -452,6 +452,7 @@ import java.util.LinkedList; 
import java.util.List;

import java.util.List;

import java.util.Locale;

import java.util.Locale;

import java.util.Map;

import java.util.Map;

import java.util.Objects;

import java.util.Set;

import java.util.Set;

import java.util.UUID;

import java.util.UUID;

import java.util.concurrent.CopyOnWriteArrayList;

import java.util.concurrent.CopyOnWriteArrayList;
@@ -5494,7 +5495,7 @@ public class ActivityManagerService extends IActivityManager.Stub 
            IIntentSender pendingResult, int matchFlags) {

            IIntentSender pendingResult, int matchFlags) {

        enforceCallingPermission(Manifest.permission.GET_INTENT_SENDER_INTENT,

        enforceCallingPermission(Manifest.permission.GET_INTENT_SENDER_INTENT,

                "queryIntentComponentsForIntentSender()");

                "queryIntentComponentsForIntentSender()");

        Preconditions.checkNotNull(pendingResult);

        Objects.requireNonNull(pendingResult);

        final PendingIntentRecord res;

        final PendingIntentRecord res;

        try {

        try {

            res = (PendingIntentRecord) pendingResult;

            res = (PendingIntentRecord) pendingResult;
@@ -5506,17 +5507,19 @@ public class ActivityManagerService extends IActivityManager.Stub 
            return null;

            return null;

        }

        }

        final int userId = res.key.userId;

        final int userId = res.key.userId;

        final int uid = res.uid;

        final String resolvedType = res.key.requestResolvedType;

        switch (res.key.type) {

        switch (res.key.type) {

            case ActivityManager.INTENT_SENDER_ACTIVITY:

            case ActivityManager.INTENT_SENDER_ACTIVITY:

                return new ParceledListSlice<>(mContext.getPackageManager()

                return new ParceledListSlice<>(mPackageManagerInt.queryIntentActivities(

                        .queryIntentActivitiesAsUser(intent, matchFlags, userId));

                        intent, resolvedType, matchFlags, uid, userId));

            case ActivityManager.INTENT_SENDER_SERVICE:

            case ActivityManager.INTENT_SENDER_SERVICE:

            case ActivityManager.INTENT_SENDER_FOREGROUND_SERVICE:

            case ActivityManager.INTENT_SENDER_FOREGROUND_SERVICE:

                return new ParceledListSlice<>(mContext.getPackageManager()

                return new ParceledListSlice<>(mPackageManagerInt.queryIntentServices(

                        .queryIntentServicesAsUser(intent, matchFlags, userId));

                        intent, matchFlags, uid, userId));

            case ActivityManager.INTENT_SENDER_BROADCAST:

            case ActivityManager.INTENT_SENDER_BROADCAST:

                return new ParceledListSlice<>(mContext.getPackageManager()

                return new ParceledListSlice<>(mPackageManagerInt.queryIntentReceivers(

                        .queryBroadcastReceiversAsUser(intent, matchFlags, userId));

                        intent, resolvedType, matchFlags, uid, userId, false));

            default: // ActivityManager.INTENT_SENDER_ACTIVITY_RESULT

            default: // ActivityManager.INTENT_SENDER_ACTIVITY_RESULT

                throw new IllegalStateException("Unsupported intent sender type: " + res.key.type);

                throw new IllegalStateException("Unsupported intent sender type: " + res.key.type);

        }

        }

services/core/java/com/android/server/pm/Computer.java

+2 −0
Original line number Original line Diff line number Diff line
@@ -112,6 +112,8 @@ public interface Computer extends PackageDataSnapshot { 
            @PackageManager.ResolveInfoFlagsBits long flags,

            @PackageManager.ResolveInfoFlagsBits long flags,

            @PackageManagerInternal.PrivateResolveFlags long privateResolveFlags,

            @PackageManagerInternal.PrivateResolveFlags long privateResolveFlags,

            int filterCallingUid, int userId, boolean resolveForStart, boolean allowDynamicSplits);

            int filterCallingUid, int userId, boolean resolveForStart, boolean allowDynamicSplits);

    @NonNull List<ResolveInfo> queryIntentActivitiesInternal(Intent intent, String resolvedType,

            long flags, int filterCallingUid, int userId);

    @NonNull List<ResolveInfo> queryIntentActivitiesInternal(Intent intent, String resolvedType,

    @NonNull List<ResolveInfo> queryIntentActivitiesInternal(Intent intent, String resolvedType,

            long flags, int userId);

            long flags, int userId);

    @NonNull List<ResolveInfo> queryIntentServicesInternal(Intent intent, String resolvedType,

    @NonNull List<ResolveInfo> queryIntentServicesInternal(Intent intent, String resolvedType,

services/core/java/com/android/server/pm/ComputerEngine.java

+9 −0
Original line number Original line Diff line number Diff line
@@ -599,6 +599,15 @@ public class ComputerEngine implements Computer { 
                resolveForStart, userId, intent);

                resolveForStart, userId, intent);

    }

    }





    @NonNull

    @Override

    public final List<ResolveInfo> queryIntentActivitiesInternal(Intent intent, String resolvedType,

            @PackageManager.ResolveInfoFlagsBits long flags, int filterCallingUid, int userId) {

        return queryIntentActivitiesInternal(

                intent, resolvedType, flags, 0 /*privateResolveFlags*/, filterCallingUid,

                userId, false /*resolveForStart*/, true /*allowDynamicSplits*/);

    }



    public final @NonNull List<ResolveInfo> queryIntentActivitiesInternal(Intent intent,

    public final @NonNull List<ResolveInfo> queryIntentActivitiesInternal(Intent intent,

            String resolvedType, @PackageManager.ResolveInfoFlagsBits long flags, int userId) {

            String resolvedType, @PackageManager.ResolveInfoFlagsBits long flags, int userId) {

        return queryIntentActivitiesInternal(

        return queryIntentActivitiesInternal(

services/core/java/com/android/server/pm/PackageManagerInternalBase.java

+2 −1
Original line number Original line Diff line number Diff line
@@ -308,7 +308,8 @@ abstract class PackageManagerInternalBase extends PackageManagerInternal { 
    public final List<ResolveInfo> queryIntentActivities(

    public final List<ResolveInfo> queryIntentActivities(

            Intent intent, String resolvedType, @PackageManager.ResolveInfoFlagsBits long flags,

            Intent intent, String resolvedType, @PackageManager.ResolveInfoFlagsBits long flags,

            int filterCallingUid, int userId) {

            int filterCallingUid, int userId) {

        return snapshot().queryIntentActivitiesInternal(intent, resolvedType, flags, userId);

        return snapshot().queryIntentActivitiesInternal(intent, resolvedType, flags,

                filterCallingUid, userId);

    }

    }





    @Override

    @Override