Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 87c60d66 authored by Vladislav Kaznacheev's avatar Vladislav Kaznacheev
Browse files

Revoke drag and drop related grants on client crash 

Add a token on the client side, linkToDeath to it on the server
side.

Bug: 29586254
Change-Id: I41ef6dd58352514035c95a4ec9e49c92ea240661
parent bc0580db

core/java/android/view/DragAndDropPermissions.java

+7 −8
Original line number Diff line number Diff line
@@ -17,7 +17,7 @@ 
package android.view;



import android.app.Activity;

import android.app.ActivityManagerNative;

import android.os.Binder;

import android.os.IBinder;

import android.os.Parcel;

import android.os.Parcelable;
@@ -54,7 +54,7 @@ public final class DragAndDropPermissions implements Parcelable { 


    private final IDragAndDropPermissions mDragAndDropPermissions;



    private IBinder mPermissionOwnerToken;

    private IBinder mTransientToken;



    /**

     * Create a new {@link DragAndDropPermissions} object to control the access permissions for
@@ -98,9 +98,8 @@ public final class DragAndDropPermissions implements Parcelable { 
     */

    public boolean takeTransient() {

        try {

            mPermissionOwnerToken = ActivityManagerNative.getDefault().

                    newUriPermissionOwner("drop");

            mDragAndDropPermissions.takeTransient(mPermissionOwnerToken);

            mTransientToken = new Binder();

            mDragAndDropPermissions.takeTransient(mTransientToken);

        } catch (RemoteException e) {

            return false;

        }
@@ -113,7 +112,7 @@ public final class DragAndDropPermissions implements Parcelable { 
    public void release() {

        try {

            mDragAndDropPermissions.release();

            mPermissionOwnerToken = null;

            mTransientToken = null;

        } catch (RemoteException e) {

        }

    }
@@ -139,11 +138,11 @@ public final class DragAndDropPermissions implements Parcelable { 
    @Override

    public void writeToParcel(Parcel destination, int flags) {

        destination.writeStrongInterface(mDragAndDropPermissions);

        destination.writeStrongBinder(mPermissionOwnerToken);

        destination.writeStrongBinder(mTransientToken);

    }



    private DragAndDropPermissions(Parcel in) {

        mDragAndDropPermissions = IDragAndDropPermissions.Stub.asInterface(in.readStrongBinder());

        mPermissionOwnerToken = in.readStrongBinder();

        mTransientToken = in.readStrongBinder();

    }

}

core/java/com/android/internal/view/IDragAndDropPermissions.aidl

+1 −1
Original line number Diff line number Diff line
@@ -24,6 +24,6 @@ import android.os.IBinder; 
 */

interface IDragAndDropPermissions {

    void take(IBinder activityToken);

    void takeTransient(IBinder permissionOwnerToken);

    void takeTransient(IBinder transientToken);

    void release();

}

services/core/java/com/android/server/wm/DragAndDropPermissionsHandler.java

+7 −4
Original line number Diff line number Diff line
@@ -40,6 +40,7 @@ class DragAndDropPermissionsHandler extends IDragAndDropPermissions.Stub 


    private IBinder mActivityToken = null;

    private IBinder mPermissionOwnerToken = null;

    private IBinder mTransientToken = null;



    DragAndDropPermissionsHandler(ClipData clipData, int sourceUid, String targetPackage, int mode,

                                  int sourceUserId, int targetUserId) {
@@ -80,12 +81,13 @@ class DragAndDropPermissionsHandler extends IDragAndDropPermissions.Stub 
    }



    @Override

    public void takeTransient(IBinder permissionOwnerToken) throws RemoteException {

    public void takeTransient(IBinder transientToken) throws RemoteException {

        if (mActivityToken != null || mPermissionOwnerToken != null) {

            return;

        }

        mPermissionOwnerToken = permissionOwnerToken;

        mPermissionOwnerToken.linkToDeath(this, 0);

        mPermissionOwnerToken = ActivityManagerNative.getDefault().newUriPermissionOwner("drop");

        mTransientToken = transientToken;

        mTransientToken.linkToDeath(this, 0);



        doTake(mPermissionOwnerToken);

    }
@@ -109,8 +111,9 @@ class DragAndDropPermissionsHandler extends IDragAndDropPermissions.Stub 
            }

        } else {

            permissionOwner = mPermissionOwnerToken;

            mPermissionOwnerToken.unlinkToDeath(this, 0);

            mPermissionOwnerToken = null;

            mTransientToken.unlinkToDeath(this, 0);

            mTransientToken = null;

        }



        for (int i = 0; i < mUris.size(); ++i) {