Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae56df41 authored by Nan Wu's avatar Nan Wu
Browse files

Fix collectExtraIntentKeys for nested LazyValue who is of custom class 

collectExtraIntentKeys calls BaseBundle.get(key) method to try to
find out if the intent contains extra intent. But if the Bundle
contains a LazyValue of custom class, and the bundle's classLoader
is not PathClassLoader (points to the custom class's path), then
it would fail - a BadParcelableException would throw.

ActivityThread only sets the intent's mExtra's classLoader
correctly. This leaves nested intents (1+ levels deep) with default
bootClassLoader. This could also happen if the bundle comes from
other IPC methods (not as a starting intent's extra bundle).

This CL fixed this issue by handling The BadParcelableException. This skips collectExtraIntentKeys method for custom and nested class objects. See go/prevent-intent-redirect-customclass for details.

Bug: 375969761
Test: Manual
Flag: android.security.prevent_intent_redirect
Change-Id: I8a1ad2030e28e4e69740d97cbd1366a874f3a2fc
parent beed0e80

core/java/android/content/Intent.java

+14 −2
Original line number Diff line number Diff line
@@ -55,6 +55,7 @@ import android.content.res.Resources; 
import android.content.res.TypedArray;

import android.graphics.Rect;

import android.net.Uri;

import android.os.BadParcelableException;

import android.os.Build;

import android.os.Bundle;

import android.os.BundleMerger;
@@ -12397,8 +12398,19 @@ public class Intent implements Parcelable, Cloneable { 
        addExtendedFlags(EXTENDED_FLAG_NESTED_INTENT_KEYS_COLLECTED);

        if (mExtras != null && !mExtras.isEmpty()) {

            for (String key : mExtras.keySet()) {

                Object value = mExtras.get(key);













                Object value;













                try {













                    value = mExtras.get(key);













                } catch (BadParcelableException e) {













                    // This could happen when the key points to a LazyValue whose class cannot be













                    // found by the classLoader - A nested object more than 1 level deeper who is













                    // of type of a custom class could trigger this situation. In such case, we













                    // ignore it since it is not an intent. However, it could be a custom type that













                    // extends from Intent. If such an object is retrieved later in another













                    // component, then trying to launch such a custom class object will fail unless













                    // removeLaunchSecurityProtection() is called before it is launched.













                    value = null;













                }















                if (value instanceof Intent intent && !visited.contains(intent)) {















                    handleNestedIntent(intent, visited, new NestedIntentKey(















                            NestedIntentKey.NESTED_INTENT_KEY_TYPE_EXTRA_PARCEL, key, 0));