Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 81f39eb6 authored by Winson Chung's avatar Winson Chung
Browse files

Refactoring app widgets to address security/performance issues. 

- Moving the service binding to AppWidgetService to prevent arbitrary apps from binding to widget services
- Requiring RemoteViewsServices to require android.permission.BIND_REMOTEVIEWS permission

Change-Id: Id135bafba998299eb278067712b8a5d8487cfd04
parent 5fb60c7a

Android.mk

+1 −0
Original line number Diff line number Diff line
@@ -167,6 +167,7 @@ LOCAL_SRC_FILES += \ 
	core/java/com/android/internal/view/IInputMethodManager.aidl \

	core/java/com/android/internal/view/IInputMethodSession.aidl \

	core/java/com/android/internal/widget/IRemoteViewsFactory.aidl \

	core/java/com/android/internal/widget/IRemoteViewsAdapterConnection.aidl \

	location/java/android/location/ICountryDetector.aidl \

	location/java/android/location/ICountryListener.aidl \

	location/java/android/location/IGeocodeProvider.aidl \

api/11.xml

+28 −0
Original line number Diff line number Diff line
@@ -188,6 +188,17 @@ 
 visibility="public"

>

</field>

<field name="BIND_REMOTEVIEWS"

 type="java.lang.String"

 transient="false"

 volatile="false"

 value="&quot;android.permission.BIND_REMOTEVIEWS&quot;"

 static="true"

 final="true"

 deprecated="not deprecated"

 visibility="public"

>

</field>

<field name="BIND_WALLPAPER"

 type="java.lang.String"

 transient="false"
@@ -252332,6 +252343,23 @@ 
<parameter name="intent" type="android.content.Intent">

</parameter>

</method>

<method name="setRemoteAdapter"

 return="void"

 abstract="false"

 native="false"

 synchronized="false"

 static="false"

 final="false"

 deprecated="not deprecated"

 visibility="public"

>

<parameter name="appWidgetId" type="int">

</parameter>

<parameter name="viewId" type="int">

</parameter>

<parameter name="intent" type="android.content.Intent">

</parameter>

</method>

<method name="setScrollPosition"

 return="void"

 abstract="false"

api/current.xml

+29 −1
Original line number Diff line number Diff line
@@ -188,6 +188,17 @@ 
 visibility="public"

>

</field>

<field name="BIND_REMOTEVIEWS"

 type="java.lang.String"

 transient="false"

 volatile="false"

 value="&quot;android.permission.BIND_REMOTEVIEWS&quot;"

 static="true"

 final="true"

 deprecated="not deprecated"

 visibility="public"

>

</field>

<field name="BIND_WALLPAPER"

 type="java.lang.String"

 transient="false"
@@ -252455,6 +252466,23 @@ 
<parameter name="intent" type="android.content.Intent">

</parameter>

</method>

<method name="setRemoteAdapter"

 return="void"

 abstract="false"

 native="false"

 synchronized="false"

 static="false"

 final="false"

 deprecated="not deprecated"

 visibility="public"

>

<parameter name="appWidgetId" type="int">

</parameter>

<parameter name="viewId" type="int">

</parameter>

<parameter name="intent" type="android.content.Intent">

</parameter>

</method>

<method name="setScrollPosition"

 return="void"

 abstract="false"
@@ -260248,7 +260276,7 @@ 
 deprecated="not deprecated"

 visibility="public"

>

<parameter name="arg0" type="T">

<parameter name="t" type="T">

</parameter>

</method>

</interface>

core/java/android/appwidget/AppWidgetManager.java

+42 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ package android.appwidget; 


import android.content.ComponentName;

import android.content.Context;

import android.content.Intent;

import android.os.IBinder;

import android.os.RemoteException;

import android.os.ServiceManager;
@@ -437,6 +438,47 @@ public class AppWidgetManager { 
        }

    }



    /**

     * Binds the RemoteViewsService for a given appWidgetId and intent.

     *

     * The appWidgetId specified must already be bound to the calling AppWidgetHost via

     * {@link android.appwidget.AppWidgetManager#bindAppWidgetId AppWidgetManager.bindAppWidgetId()}.

     *

     * @param appWidgetId   The AppWidget instance for which to bind the RemoteViewsService.

     * @param intent        The intent of the service which will be providing the data to the

     *                      RemoteViewsAdapter.

     * @param connection    The callback interface to be notified when a connection is made or lost.

     * @hide

     */

    public void bindRemoteViewsService(int appWidgetId, Intent intent, IBinder connection) {

        try {

            sService.bindRemoteViewsService(appWidgetId, intent, connection);

        }

        catch (RemoteException e) {

            throw new RuntimeException("system server dead?", e);

        }

    }



    /**

     * Unbinds the RemoteViewsService for a given appWidgetId and intent.

     *

     * The appWidgetId specified muse already be bound to the calling AppWidgetHost via

     * {@link android.appwidget.AppWidgetManager#bindAppWidgetId AppWidgetManager.bindAppWidgetId()}.

     *

     * @param appWidgetId   The AppWidget instance for which to bind the RemoteViewsService.

     * @param intent        The intent of the service which will be providing the data to the

     *                      RemoteViewsAdapter.

     * @hide

     */

    public void unbindRemoteViewsService(int appWidgetId, Intent intent) {

        try {

            sService.unbindRemoteViewsService(appWidgetId, intent);

        }

        catch (RemoteException e) {

            throw new RuntimeException("system server dead?", e);

        }

    }



    /**

     * Get the list of appWidgetIds that have been bound to the given AppWidget

     * provider.

core/java/android/widget/RemoteViews.java

+22 −0
Original line number Diff line number Diff line
@@ -58,6 +58,12 @@ public class RemoteViews implements Parcelable, Filter { 
    

    private static final String LOG_TAG = "RemoteViews";

    

    /**

     * The intent extra that contains the appWidgetId.

     * @hide

     */

    static final String EXTRA_REMOTEADAPTER_APPWIDGET_ID = "remoteAdapterAppWidgetId";



    /**

     * The package name of the package containing the layout 

     * resource. (Added to the parcel)
@@ -1276,6 +1282,22 @@ public class RemoteViews implements Parcelable, Filter { 
     *            providing data to the RemoteViewsAdapter

     */

    public void setRemoteAdapter(int viewId, Intent intent) {

        // Do nothing.  This method will be removed after all widgets have been updated to the

        // new API.

    }



    /**

     * Equivalent to calling {@link android.widget.AbsListView#setRemoteViewsAdapter(Intent)}.

     *

     * @param appWidgetId The id of the app widget which contains the specified view

     * @param viewId The id of the view whose text should change

     * @param intent The intent of the service which will be

     *            providing data to the RemoteViewsAdapter

     */

    public void setRemoteAdapter(int appWidgetId, int viewId, Intent intent) {

        // Embed the AppWidget Id for use in RemoteViewsAdapter when connecting to the intent

        // RemoteViewsService

        intent.putExtra(EXTRA_REMOTEADAPTER_APPWIDGET_ID, appWidgetId);

        setIntent(viewId, "setRemoteViewsAdapter", intent);

    }