Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6c4a347b authored by John Wu's avatar John Wu Committed by Beth Thibodeau
Browse files

Proper PendingIntent.queryIntentComponents implementation 

PendingIntent.queryIntentComponents currently does not take the pending
intent creator UID into account when performing component resolution.
This will return incorrect results, since explicit intents with
non-matching intent filter can only be resolved if the sender is the
same UID as the target component.

Bug: 238415222
Bug: 271845008
Test: atest CtsContentTestCases:PackageManagerTest
Change-Id: Ib4e1c04c8de4e9bcee35d584dfb213954ec65449
Merged-In: Ib4e1c04c8de4e9bcee35d584dfb213954ec65449
parent f8ba53d9

services/core/java/com/android/server/am/ActivityManagerService.java

+10 −7
Original line number Diff line number Diff line
@@ -450,6 +450,7 @@ import java.util.LinkedList; 
import java.util.List;

import java.util.Locale;

import java.util.Map;

import java.util.Objects;

import java.util.Set;

import java.util.UUID;

import java.util.concurrent.CopyOnWriteArrayList;
@@ -5535,7 +5536,7 @@ public class ActivityManagerService extends IActivityManager.Stub 
            IIntentSender pendingResult, int matchFlags) {

        enforceCallingPermission(Manifest.permission.GET_INTENT_SENDER_INTENT,

                "queryIntentComponentsForIntentSender()");

        Preconditions.checkNotNull(pendingResult);

        Objects.requireNonNull(pendingResult);

        final PendingIntentRecord res;

        try {

            res = (PendingIntentRecord) pendingResult;
@@ -5547,17 +5548,19 @@ public class ActivityManagerService extends IActivityManager.Stub 
            return null;

        }

        final int userId = res.key.userId;

        final int uid = res.uid;

        final String resolvedType = res.key.requestResolvedType;

        switch (res.key.type) {

            case ActivityManager.INTENT_SENDER_ACTIVITY:

                return new ParceledListSlice<>(mContext.getPackageManager()

                        .queryIntentActivitiesAsUser(intent, matchFlags, userId));

                return new ParceledListSlice<>(mPackageManagerInt.queryIntentActivities(

                        intent, resolvedType, matchFlags, uid, userId));

            case ActivityManager.INTENT_SENDER_SERVICE:

            case ActivityManager.INTENT_SENDER_FOREGROUND_SERVICE:

                return new ParceledListSlice<>(mContext.getPackageManager()

                        .queryIntentServicesAsUser(intent, matchFlags, userId));

                return new ParceledListSlice<>(mPackageManagerInt.queryIntentServices(

                        intent, matchFlags, uid, userId));

            case ActivityManager.INTENT_SENDER_BROADCAST:

                return new ParceledListSlice<>(mContext.getPackageManager()

                        .queryBroadcastReceiversAsUser(intent, matchFlags, userId));

                return new ParceledListSlice<>(mPackageManagerInt.queryIntentReceivers(

                        intent, resolvedType, matchFlags, uid, userId, false));

            default: // ActivityManager.INTENT_SENDER_ACTIVITY_RESULT

                throw new IllegalStateException("Unsupported intent sender type: " + res.key.type);

        }

services/core/java/com/android/server/pm/Computer.java

+2 −0
Original line number Diff line number Diff line
@@ -112,6 +112,8 @@ public interface Computer extends PackageDataSnapshot { 
            @PackageManager.ResolveInfoFlagsBits long flags,

            @PackageManagerInternal.PrivateResolveFlags long privateResolveFlags,

            int filterCallingUid, int userId, boolean resolveForStart, boolean allowDynamicSplits);

    @NonNull List<ResolveInfo> queryIntentActivitiesInternal(Intent intent, String resolvedType,

            long flags, int filterCallingUid, int userId);

    @NonNull List<ResolveInfo> queryIntentActivitiesInternal(Intent intent, String resolvedType,

            long flags, int userId);

    @NonNull List<ResolveInfo> queryIntentServicesInternal(Intent intent, String resolvedType,

services/core/java/com/android/server/pm/ComputerEngine.java

+9 −0
Original line number Diff line number Diff line
@@ -599,6 +599,15 @@ public class ComputerEngine implements Computer { 
                resolveForStart, userId, intent);

    }



    @NonNull

    @Override

    public final List<ResolveInfo> queryIntentActivitiesInternal(Intent intent, String resolvedType,

            @PackageManager.ResolveInfoFlagsBits long flags, int filterCallingUid, int userId) {

        return queryIntentActivitiesInternal(

                intent, resolvedType, flags, 0 /*privateResolveFlags*/, filterCallingUid,

                userId, false /*resolveForStart*/, true /*allowDynamicSplits*/);

    }



    public final @NonNull List<ResolveInfo> queryIntentActivitiesInternal(Intent intent,

            String resolvedType, @PackageManager.ResolveInfoFlagsBits long flags, int userId) {

        return queryIntentActivitiesInternal(

services/core/java/com/android/server/pm/PackageManagerInternalBase.java

+2 −1
Original line number Diff line number Diff line
@@ -308,7 +308,8 @@ abstract class PackageManagerInternalBase extends PackageManagerInternal { 
    public final List<ResolveInfo> queryIntentActivities(

            Intent intent, String resolvedType, @PackageManager.ResolveInfoFlagsBits long flags,

            int filterCallingUid, int userId) {

        return snapshot().queryIntentActivitiesInternal(intent, resolvedType, flags, userId);

        return snapshot().queryIntentActivitiesInternal(intent, resolvedType, flags,

                filterCallingUid, userId);

    }



    @Override