Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 850c8129 authored by TYM Tsai's avatar TYM Tsai
Browse files

Filter the content of the Bundles used as extras and styling APIs 

Adds filter to prevent passing binder objects in the extras and styling
APIs for inline suggestions. Avoids these to be used to send over remote
objects for Autofill provider and IME to communicate through private APIs
bypassing the OS.

Bug: 152316540
Test: atest CtsAutoFillServiceTestCases
Test: atest InlineSuggestionsRequestTest
Change-Id: I00940a845ed0e2546cbe09fa36e2439869c2f783
parent f21e3a96

core/java/android/inputmethodservice/InlineSuggestionSession.java

+1 −0
Original line number Diff line number Diff line
@@ -169,6 +169,7 @@ class InlineSuggestionSession { 
                mCallback.onInlineSuggestionsUnsupported();

            } else {

                request.setHostInputToken(mHostInputTokenSupplier.get());

                request.filterContentTypes();

                mResponseCallback = new InlineSuggestionsResponseCallbackImpl(this);

                mCallback.onInlineSuggestionsRequest(request, mResponseCallback);

            }

core/java/android/service/autofill/AutofillService.java

+2 −0
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ import android.annotation.Nullable; 
import android.annotation.SdkConstant;

import android.app.Service;

import android.content.Intent;

import android.os.BaseBundle;

import android.os.CancellationSignal;

import android.os.Handler;

import android.os.IBinder;
@@ -611,6 +612,7 @@ public abstract class AutofillService extends Service { 
    public void onCreate() {

        super.onCreate();

        mHandler = new Handler(Looper.getMainLooper(), null, true);

        BaseBundle.setShouldDefuse(true);

    }



    @Override

core/java/android/service/autofill/InlineSuggestionRenderService.java

+2 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ import android.app.slice.Slice; 
import android.content.Intent;

import android.content.IntentSender;

import android.graphics.PixelFormat;

import android.os.BaseBundle;

import android.os.Bundle;

import android.os.Handler;

import android.os.IBinder;
@@ -146,6 +147,7 @@ public abstract class InlineSuggestionRenderService extends Service { 
    @Override

    @Nullable

    public final IBinder onBind(@NonNull Intent intent) {

        BaseBundle.setShouldDefuse(true);

        if (SERVICE_INTERFACE.equals(intent.getAction())) {

            return new IInlineSuggestionRenderService.Stub() {

                @Override

core/java/android/service/autofill/augmented/AugmentedAutofillService.java

+2 −0
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@ import android.app.Service; 
import android.content.ComponentName;

import android.content.Intent;

import android.graphics.Rect;

import android.os.BaseBundle;

import android.os.Build;

import android.os.Bundle;

import android.os.CancellationSignal;
@@ -132,6 +133,7 @@ public abstract class AugmentedAutofillService extends Service { 
    public void onCreate() {

        super.onCreate();

        mHandler = new Handler(Looper.getMainLooper(), null, true);

        BaseBundle.setShouldDefuse(true);

    }



    /** @hide */

core/java/android/view/inputmethod/InlineSuggestionsRequest.java

+15 −2
Original line number Diff line number Diff line
@@ -126,6 +126,19 @@ public final class InlineSuggestionsRequest implements Parcelable { 
        Preconditions.checkState(mMaxSuggestionCount >= mInlinePresentationSpecs.size());

    }



    /**

     * Removes the remote objects from the bundles within the {@Code mExtras} and the

     * {@code mInlinePresentationSpecs}.

     *

     * @hide

     */

    public void filterContentTypes() {

        InlinePresentationStyleUtils.filterContentTypes(mExtras);

        for (int i = 0; i < mInlinePresentationSpecs.size(); i++) {

            mInlinePresentationSpecs.get(i).filterContentTypes();

        }

    }



    private static int defaultMaxSuggestionCount() {

        return SUGGESTION_COUNT_UNLIMITED;

    }
@@ -582,10 +595,10 @@ public final class InlineSuggestionsRequest implements Parcelable { 
    }



    @DataClass.Generated(

            time = 1586992395497L,

            time = 1587537617922L,

            codegenVersion = "1.0.15",

            sourceFile = "frameworks/base/core/java/android/view/inputmethod/InlineSuggestionsRequest.java",

            inputSignatures = "public static final  int SUGGESTION_COUNT_UNLIMITED\nprivate final  int mMaxSuggestionCount\nprivate final @android.annotation.NonNull java.util.List<android.widget.inline.InlinePresentationSpec> mInlinePresentationSpecs\nprivate @android.annotation.NonNull java.lang.String mHostPackageName\nprivate @android.annotation.NonNull android.os.LocaleList mSupportedLocales\nprivate @android.annotation.NonNull android.os.Bundle mExtras\nprivate @android.annotation.Nullable android.os.IBinder mHostInputToken\nprivate  int mHostDisplayId\npublic  void setHostInputToken(android.os.IBinder)\nprivate  boolean extrasEquals(android.os.Bundle)\nprivate  void parcelHostInputToken(android.os.Parcel,int)\nprivate @android.annotation.Nullable android.os.IBinder unparcelHostInputToken(android.os.Parcel)\npublic  void setHostDisplayId(int)\nprivate  void onConstructed()\nprivate static  int defaultMaxSuggestionCount()\nprivate static  java.lang.String defaultHostPackageName()\nprivate static  android.os.LocaleList defaultSupportedLocales()\nprivate static @android.annotation.Nullable android.os.IBinder defaultHostInputToken()\nprivate static @android.annotation.Nullable int defaultHostDisplayId()\nprivate static @android.annotation.NonNull android.os.Bundle defaultExtras()\nclass InlineSuggestionsRequest extends java.lang.Object implements [android.os.Parcelable]\n@com.android.internal.util.DataClass(genEqualsHashCode=true, genToString=true, genBuilder=true)\nabstract  android.view.inputmethod.InlineSuggestionsRequest.Builder setInlinePresentationSpecs(java.util.List<android.widget.inline.InlinePresentationSpec>)\nabstract  android.view.inputmethod.InlineSuggestionsRequest.Builder setHostPackageName(java.lang.String)\nabstract  android.view.inputmethod.InlineSuggestionsRequest.Builder setHostInputToken(android.os.IBinder)\nabstract  android.view.inputmethod.InlineSuggestionsRequest.Builder setHostDisplayId(int)\nclass BaseBuilder extends java.lang.Object implements []")

            inputSignatures = "public static final  int SUGGESTION_COUNT_UNLIMITED\nprivate final  int mMaxSuggestionCount\nprivate final @android.annotation.NonNull java.util.List<android.widget.inline.InlinePresentationSpec> mInlinePresentationSpecs\nprivate @android.annotation.NonNull java.lang.String mHostPackageName\nprivate @android.annotation.NonNull android.os.LocaleList mSupportedLocales\nprivate @android.annotation.NonNull android.os.Bundle mExtras\nprivate @android.annotation.Nullable android.os.IBinder mHostInputToken\nprivate  int mHostDisplayId\npublic  void setHostInputToken(android.os.IBinder)\nprivate  boolean extrasEquals(android.os.Bundle)\nprivate  void parcelHostInputToken(android.os.Parcel,int)\nprivate @android.annotation.Nullable android.os.IBinder unparcelHostInputToken(android.os.Parcel)\npublic  void setHostDisplayId(int)\nprivate  void onConstructed()\npublic  void filterContentTypes()\nprivate static  int defaultMaxSuggestionCount()\nprivate static  java.lang.String defaultHostPackageName()\nprivate static  android.os.LocaleList defaultSupportedLocales()\nprivate static @android.annotation.Nullable android.os.IBinder defaultHostInputToken()\nprivate static @android.annotation.Nullable int defaultHostDisplayId()\nprivate static @android.annotation.NonNull android.os.Bundle defaultExtras()\nclass InlineSuggestionsRequest extends java.lang.Object implements [android.os.Parcelable]\n@com.android.internal.util.DataClass(genEqualsHashCode=true, genToString=true, genBuilder=true)\nabstract  android.view.inputmethod.InlineSuggestionsRequest.Builder setInlinePresentationSpecs(java.util.List<android.widget.inline.InlinePresentationSpec>)\nabstract  android.view.inputmethod.InlineSuggestionsRequest.Builder setHostPackageName(java.lang.String)\nabstract  android.view.inputmethod.InlineSuggestionsRequest.Builder setHostInputToken(android.os.IBinder)\nabstract  android.view.inputmethod.InlineSuggestionsRequest.Builder setHostDisplayId(int)\nclass BaseBuilder extends java.lang.Object implements []")

    @Deprecated

    private void __metadata() {}