Loading services/core/java/com/android/server/notification/NotificationManagerService.java +20 −9 Original line number Diff line number Diff line Loading @@ -7225,7 +7225,15 @@ public class NotificationManagerService extends SystemService { callingUid, userId, true, false, "cancelNotificationWithTag", pkg); // ensure opPkg is delegate if does not match pkg int uid = resolveNotificationUid(opPkg, pkg, callingUid, userId); int uid = INVALID_UID; try { uid = resolveNotificationUid(opPkg, pkg, callingUid, userId); } catch (NameNotFoundException e) { // package either never existed so there's no posted notification or it's being // uninstalled so we'll be cleaning it up soon. log and return immediately below. } if (uid == INVALID_UID) { Slog.w(TAG, opPkg + ":" + callingUid + " trying to cancel notification " Loading Loading @@ -7319,7 +7327,13 @@ public class NotificationManagerService extends SystemService { // Can throw a SecurityException if the calling uid doesn't have permission to post // as "pkg" final int notificationUid = resolveNotificationUid(opPkg, pkg, callingUid, userId); int notificationUid = INVALID_UID; try { notificationUid = resolveNotificationUid(opPkg, pkg, callingUid, userId); } catch (NameNotFoundException e) { // not great - throw immediately below } if (notificationUid == INVALID_UID) { throw new SecurityException("Caller " + opPkg + ":" + callingUid Loading Loading @@ -7876,7 +7890,8 @@ public class NotificationManagerService extends SystemService { } @VisibleForTesting int resolveNotificationUid(String callingPkg, String targetPkg, int callingUid, int userId) { int resolveNotificationUid(String callingPkg, String targetPkg, int callingUid, int userId) throws NameNotFoundException { if (userId == USER_ALL) { userId = USER_SYSTEM; } Loading @@ -7887,12 +7902,8 @@ public class NotificationManagerService extends SystemService { return callingUid; } int targetUid = INVALID_UID; try { targetUid = mPackageManagerClient.getPackageUidAsUser(targetPkg, userId); } catch (NameNotFoundException e) { /* ignore, handled by caller */ } int targetUid = mPackageManagerClient.getPackageUidAsUser(targetPkg, userId); // posted from app A on behalf of app B if (isCallerAndroid(callingPkg, callingUid) || mPreferencesHelper.isDelegateAllowed( Loading services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java +35 −0 Original line number Diff line number Diff line Loading @@ -15638,4 +15638,39 @@ public class NotificationManagerServiceTest extends UiServiceTestCase { assertThat(mService.checkDisqualifyingFeatures(mUserId, mUid, 0, null, r, false, false)) .isTrue(); } @Test public void testClearUIJFromUninstallingPackage() throws Exception { NotificationRecord r = generateNotificationRecord(mTestNotificationChannel, 0, mUserId, "bar"); mService.addNotification(r); when(mPackageManagerClient.getPackageUidAsUser(anyString(), anyInt())) .thenThrow(PackageManager.NameNotFoundException.class); when(mPackageManagerInternal.isSameApp(anyString(), anyInt(), anyInt())).thenReturn(false); mInternalService.cancelNotification(mPkg, mPkg, mUid, 0, r.getSbn().getTag(), r.getSbn().getId(), mUserId); // no exception } @Test public void testPostFromMissingPackage_throws() throws Exception { NotificationRecord r = generateNotificationRecord(mTestNotificationChannel, 0, mUserId, "bar"); when(mPackageManagerClient.getPackageUidAsUser(anyString(), anyInt())) .thenThrow(PackageManager.NameNotFoundException.class); when(mPackageManagerInternal.isSameApp(anyString(), anyInt(), anyInt())).thenReturn(false); try { mBinderService.enqueueNotificationWithTag(mPkg, mPkg, r.getSbn().getTag(), r.getSbn().getId(), r.getSbn().getNotification(), r.getSbn().getUserId()); fail("Allowed to post a notification for an absent package"); } catch (SecurityException e) { // yay } } } Loading
services/core/java/com/android/server/notification/NotificationManagerService.java +20 −9 Original line number Diff line number Diff line Loading @@ -7225,7 +7225,15 @@ public class NotificationManagerService extends SystemService { callingUid, userId, true, false, "cancelNotificationWithTag", pkg); // ensure opPkg is delegate if does not match pkg int uid = resolveNotificationUid(opPkg, pkg, callingUid, userId); int uid = INVALID_UID; try { uid = resolveNotificationUid(opPkg, pkg, callingUid, userId); } catch (NameNotFoundException e) { // package either never existed so there's no posted notification or it's being // uninstalled so we'll be cleaning it up soon. log and return immediately below. } if (uid == INVALID_UID) { Slog.w(TAG, opPkg + ":" + callingUid + " trying to cancel notification " Loading Loading @@ -7319,7 +7327,13 @@ public class NotificationManagerService extends SystemService { // Can throw a SecurityException if the calling uid doesn't have permission to post // as "pkg" final int notificationUid = resolveNotificationUid(opPkg, pkg, callingUid, userId); int notificationUid = INVALID_UID; try { notificationUid = resolveNotificationUid(opPkg, pkg, callingUid, userId); } catch (NameNotFoundException e) { // not great - throw immediately below } if (notificationUid == INVALID_UID) { throw new SecurityException("Caller " + opPkg + ":" + callingUid Loading Loading @@ -7876,7 +7890,8 @@ public class NotificationManagerService extends SystemService { } @VisibleForTesting int resolveNotificationUid(String callingPkg, String targetPkg, int callingUid, int userId) { int resolveNotificationUid(String callingPkg, String targetPkg, int callingUid, int userId) throws NameNotFoundException { if (userId == USER_ALL) { userId = USER_SYSTEM; } Loading @@ -7887,12 +7902,8 @@ public class NotificationManagerService extends SystemService { return callingUid; } int targetUid = INVALID_UID; try { targetUid = mPackageManagerClient.getPackageUidAsUser(targetPkg, userId); } catch (NameNotFoundException e) { /* ignore, handled by caller */ } int targetUid = mPackageManagerClient.getPackageUidAsUser(targetPkg, userId); // posted from app A on behalf of app B if (isCallerAndroid(callingPkg, callingUid) || mPreferencesHelper.isDelegateAllowed( Loading
services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java +35 −0 Original line number Diff line number Diff line Loading @@ -15638,4 +15638,39 @@ public class NotificationManagerServiceTest extends UiServiceTestCase { assertThat(mService.checkDisqualifyingFeatures(mUserId, mUid, 0, null, r, false, false)) .isTrue(); } @Test public void testClearUIJFromUninstallingPackage() throws Exception { NotificationRecord r = generateNotificationRecord(mTestNotificationChannel, 0, mUserId, "bar"); mService.addNotification(r); when(mPackageManagerClient.getPackageUidAsUser(anyString(), anyInt())) .thenThrow(PackageManager.NameNotFoundException.class); when(mPackageManagerInternal.isSameApp(anyString(), anyInt(), anyInt())).thenReturn(false); mInternalService.cancelNotification(mPkg, mPkg, mUid, 0, r.getSbn().getTag(), r.getSbn().getId(), mUserId); // no exception } @Test public void testPostFromMissingPackage_throws() throws Exception { NotificationRecord r = generateNotificationRecord(mTestNotificationChannel, 0, mUserId, "bar"); when(mPackageManagerClient.getPackageUidAsUser(anyString(), anyInt())) .thenThrow(PackageManager.NameNotFoundException.class); when(mPackageManagerInternal.isSameApp(anyString(), anyInt(), anyInt())).thenReturn(false); try { mBinderService.enqueueNotificationWithTag(mPkg, mPkg, r.getSbn().getTag(), r.getSbn().getId(), r.getSbn().getNotification(), r.getSbn().getUserId()); fail("Allowed to post a notification for an absent package"); } catch (SecurityException e) { // yay } } }