Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b14e524f authored by Ganesh Olekar's avatar Ganesh Olekar Committed by Automerger Merge Worker
Browse files

Merge "Validate pid can be trusted" into sc-dev am: 45312b83 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/16461958

Change-Id: I47da71211e30902d5f489f0dec109056b9503707
parents d797c5a6 45312b83

core/api/test-current.txt

+1 −0
Original line number Diff line number Diff line
@@ -683,6 +683,7 @@ package android.content { 
    ctor public AttributionSource(int, @Nullable String, @Nullable String);

    ctor public AttributionSource(int, @Nullable String, @Nullable String, @NonNull android.os.IBinder);

    ctor public AttributionSource(int, @Nullable String, @Nullable String, @Nullable java.util.Set<java.lang.String>, @Nullable android.content.AttributionSource);

    method public void enforceCallingPid();

  }



  public final class AutofillOptions implements android.os.Parcelable {

core/java/android/content/AttributionSource.java

+42 −4
Original line number Diff line number Diff line
@@ -154,8 +154,8 @@ public final class AttributionSource implements Parcelable { 
        this(AttributionSourceState.CREATOR.createFromParcel(in));



        // Since we just unpacked this object as part of it transiting a Binder

        // call, this is the perfect time to enforce that its UID can be trusted

        enforceCallingUid();

        // call, this is the perfect time to enforce that its UID and PID can be trusted

        enforceCallingUidAndPid();

    }



    /** @hide */
@@ -225,14 +225,25 @@ public final class AttributionSource implements Parcelable { 
        }

    }



    /**

     * If you are handling an IPC and you don't trust the caller you need to validate whether the

     * attribution source is one for the calling app to prevent the caller to pass you a source from

     * another app without including themselves in the attribution chain.

     *

     * @throws SecurityException if the attribution source cannot be trusted to be from the caller.

     */

    private void enforceCallingUidAndPid() {

        enforceCallingUid();

        enforceCallingPid();

    }



    /**

     * If you are handling an IPC and you don't trust the caller you need to validate

     * whether the attribution source is one for the calling app to prevent the caller

     * to pass you a source from another app without including themselves in the

     * attribution chain.

     *

     * @throws SecurityException if the attribution source cannot be trusted to be

     * from the caller.

     * @throws SecurityException if the attribution source cannot be trusted to be from the caller.

     */

    public void enforceCallingUid() {

        if (!checkCallingUid()) {
@@ -261,6 +272,33 @@ public final class AttributionSource implements Parcelable { 
        return true;

    }



    /**

     * Validate that the pid being claimed for the calling app is not spoofed

     *

     * @throws SecurityException if the attribution source cannot be trusted to be from the caller.

     * @hide

     */

    @TestApi

    public void enforceCallingPid() {

        if (!checkCallingPid()) {

            throw new SecurityException("Calling pid: " + Binder.getCallingPid()

                    + " doesn't match source pid: " + mAttributionSourceState.pid);

        }

    }



    /**

     * Validate that the pid being claimed for the calling app is not spoofed

     *

     * @return if the attribution source cannot be trusted to be from the caller.

     */

    private boolean checkCallingPid() {

        final int callingPid = Binder.getCallingPid();

        if (mAttributionSourceState.pid != -1 && callingPid != mAttributionSourceState.pid) {

            return false;

        }

        return true;

    }



    @Override

    public String toString() {

        if (Build.IS_DEBUGGABLE) {