Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 96e0524c authored by Nan Wu's avatar Nan Wu Committed by Android Build Coastguard Worker
Browse files

Rescind BAL privilege when ShortcutService sends the callback PI 

When AppWidgetManager.requestPinAppWidget is called from a client,
The passed in callback PendingIntent is called from the system
server. This allows the PendingIntent to be able to bypass BAL
checks.

Bug: 278722815
Test: manual test. BackgroundActivityLaunchTest. Regression like
      RequestPinAppWidgetTest, PeopleSpaceWidgetManagerTest, etc.
(cherry picked from commit eb904695)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:0a0778e96d7da3fa8169abdf9261ed62809539fa)
Merged-In: I2df9de272192c9a149a9ff519c96e6e0e8304040
Change-Id: I2df9de272192c9a149a9ff519c96e6e0e8304040
parent 58fa254a

services/core/java/com/android/server/pm/ShortcutService.java

+6 −1
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
 */

package com.android.server.pm;



import static android.app.ActivityOptions.MODE_BACKGROUND_ACTIVITY_START_DENIED;

import static android.provider.DeviceConfig.NAMESPACE_SYSTEMUI;



import android.Manifest.permission;
@@ -24,6 +25,7 @@ import android.annotation.Nullable; 
import android.annotation.UserIdInt;

import android.app.ActivityManager;

import android.app.ActivityManagerInternal;

import android.app.ActivityOptions;

import android.app.AppGlobals;

import android.app.IUidObserver;

import android.app.IUriGrantsManager;
@@ -4407,8 +4409,11 @@ public class ShortcutService extends IShortcutService.Stub { 
            return;

        }

        try {

            ActivityOptions options = ActivityOptions.makeBasic()

                    .setPendingIntentBackgroundActivityStartMode(

                            MODE_BACKGROUND_ACTIVITY_START_DENIED);

            intentSender.sendIntent(mContext, /* code= */ 0, extras,

                    /* onFinished=*/ null, /* handler= */ null);

                    /* onFinished=*/ null, /* handler= */ null, null, options.toBundle());

        } catch (SendIntentException e) {

            Slog.w(TAG, "sendIntent failed().", e);

        }