Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bccb8bec authored by Automerger Merge Worker's avatar Automerger Merge Worker
Browse files

RESTRICT AUTOMERGE TextClassifier cross-user vulnerability in direct-reply am: 34e380cd 

Change-Id: I43130453f6b576679c52be643344589ac624dadd
parents 1ceaf86e 34e380cd

core/java/android/view/textclassifier/ActionsModelParamsSupplier.java

+3 −1
Original line number Diff line number Diff line
@@ -60,7 +60,9 @@ public final class ActionsModelParamsSupplier implements 
    private boolean mParsed = true;



    public ActionsModelParamsSupplier(Context context, @Nullable Runnable onChangedListener) {

        mAppContext = Preconditions.checkNotNull(context).getApplicationContext();

        final Context appContext = Preconditions.checkNotNull(context).getApplicationContext();

        // Some contexts don't have an app context.

        mAppContext = appContext != null ? appContext : context;

        mOnChangedListener = onChangedListener == null ? () -> {} : onChangedListener;

        mSettingsObserver = new SettingsObserver(mAppContext, () -> {

            synchronized (mLock) {

core/java/android/view/textclassifier/ConversationActions.java

+25 −0
Original line number Diff line number Diff line
@@ -21,10 +21,12 @@ import android.annotation.IntRange; 
import android.annotation.NonNull;

import android.annotation.Nullable;

import android.annotation.StringDef;

import android.annotation.UserIdInt;

import android.app.Person;

import android.os.Bundle;

import android.os.Parcel;

import android.os.Parcelable;

import android.os.UserHandle;

import android.text.SpannedString;



import com.android.internal.annotations.VisibleForTesting;
@@ -316,6 +318,8 @@ public final class ConversationActions implements Parcelable { 
        private final List<String> mHints;

        @Nullable

        private String mCallingPackageName;

        @UserIdInt

        private int mUserId = UserHandle.USER_NULL;

        @NonNull

        private Bundle mExtras;
@@ -340,6 +344,7 @@ public final class ConversationActions implements Parcelable { 
            List<String> hints = new ArrayList<>();

            in.readStringList(hints);

            String callingPackageName = in.readString();

            int userId = in.readInt();

            Bundle extras = in.readBundle();

            Request request = new Request(

                    conversation,
@@ -348,6 +353,7 @@ public final class ConversationActions implements Parcelable { 
                    hints,

                    extras);

            request.setCallingPackageName(callingPackageName);

            request.setUserId(userId);

            return request;

        }
@@ -358,6 +364,7 @@ public final class ConversationActions implements Parcelable { 
            parcel.writeInt(mMaxSuggestions);

            parcel.writeStringList(mHints);

            parcel.writeString(mCallingPackageName);

            parcel.writeInt(mUserId);

            parcel.writeBundle(mExtras);

        }
@@ -427,6 +434,24 @@ public final class ConversationActions implements Parcelable { 
            return mCallingPackageName;

        }



        /**

         * Sets the id of the user that sent this request.

         * <p>

         * Package-private for SystemTextClassifier's use.

         */

        void setUserId(@UserIdInt int userId) {

            mUserId = userId;

        }



        /**

         * Returns the id of the user that sent this request.

         * @hide

         */

        @UserIdInt

        public int getUserId() {

            return mUserId;

        }



        /**

         * Returns the extended data related to this request.

         *

core/java/android/view/textclassifier/SelectionEvent.java

+28 −3
Original line number Diff line number Diff line
@@ -19,8 +19,10 @@ package android.view.textclassifier; 
import android.annotation.IntDef;

import android.annotation.NonNull;

import android.annotation.Nullable;

import android.annotation.UserIdInt;

import android.os.Parcel;

import android.os.Parcelable;

import android.os.UserHandle;

import android.view.textclassifier.TextClassifier.EntityType;

import android.view.textclassifier.TextClassifier.WidgetType;
@@ -127,6 +129,7 @@ public final class SelectionEvent implements Parcelable { 
    private String mWidgetType = TextClassifier.WIDGET_TYPE_UNKNOWN;

    private @InvocationMethod int mInvocationMethod;

    @Nullable private String mWidgetVersion;

    private @UserIdInt int mUserId = UserHandle.USER_NULL;

    @Nullable private String mResultId;

    private long mEventTime;

    private long mDurationSinceSessionStart;
@@ -158,6 +161,7 @@ public final class SelectionEvent implements Parcelable { 
        mEntityType = in.readString();

        mWidgetVersion = in.readInt() > 0 ? in.readString() : null;

        mPackageName = in.readString();

        mUserId = in.readInt();

        mWidgetType = in.readString();

        mInvocationMethod = in.readInt();

        mResultId = in.readString();
@@ -184,6 +188,7 @@ public final class SelectionEvent implements Parcelable { 
            dest.writeString(mWidgetVersion);

        }

        dest.writeString(mPackageName);

        dest.writeInt(mUserId);

        dest.writeString(mWidgetType);

        dest.writeInt(mInvocationMethod);

        dest.writeString(mResultId);
@@ -400,6 +405,24 @@ public final class SelectionEvent implements Parcelable { 
        return mPackageName;

    }



    /**

     * Sets the id of this event's user.

     * <p>

     * Package-private for SystemTextClassifier's use.

     */

    void setUserId(@UserIdInt int userId) {

        mUserId = userId;

    }



    /**

     * Returns the id of this event's user.

     * @hide

     */

    @UserIdInt

    public int getUserId() {

        return mUserId;

    }



    /**

     * Returns the type of widget that was involved in triggering this event.

     */
@@ -426,6 +449,7 @@ public final class SelectionEvent implements Parcelable { 
        mPackageName = context.getPackageName();

        mWidgetType = context.getWidgetType();

        mWidgetVersion = context.getWidgetVersion();

        mUserId = context.getUserId();

    }



    /**
@@ -612,7 +636,7 @@ public final class SelectionEvent implements Parcelable { 
    @Override

    public int hashCode() {

        return Objects.hash(mAbsoluteStart, mAbsoluteEnd, mEventType, mEntityType,

                mWidgetVersion, mPackageName, mWidgetType, mInvocationMethod, mResultId,

                mWidgetVersion, mPackageName, mUserId, mWidgetType, mInvocationMethod, mResultId,

                mEventTime, mDurationSinceSessionStart, mDurationSincePreviousEvent,

                mEventIndex, mSessionId, mStart, mEnd, mSmartStart, mSmartEnd);

    }
@@ -633,6 +657,7 @@ public final class SelectionEvent implements Parcelable { 
                && Objects.equals(mEntityType, other.mEntityType)

                && Objects.equals(mWidgetVersion, other.mWidgetVersion)

                && Objects.equals(mPackageName, other.mPackageName)

                && mUserId == other.mUserId

                && Objects.equals(mWidgetType, other.mWidgetType)

                && mInvocationMethod == other.mInvocationMethod

                && Objects.equals(mResultId, other.mResultId)
@@ -652,12 +677,12 @@ public final class SelectionEvent implements Parcelable { 
        return String.format(Locale.US,

                "SelectionEvent {absoluteStart=%d, absoluteEnd=%d, eventType=%d, entityType=%s, "

                        + "widgetVersion=%s, packageName=%s, widgetType=%s, invocationMethod=%s, "

                        + "resultId=%s, eventTime=%d, durationSinceSessionStart=%d, "

                        + "userId=%d, resultId=%s, eventTime=%d, durationSinceSessionStart=%d, "

                        + "durationSincePreviousEvent=%d, eventIndex=%d,"

                        + "sessionId=%s, start=%d, end=%d, smartStart=%d, smartEnd=%d}",

                mAbsoluteStart, mAbsoluteEnd, mEventType, mEntityType,

                mWidgetVersion, mPackageName, mWidgetType, mInvocationMethod,

                mResultId, mEventTime, mDurationSinceSessionStart,

                mUserId, mResultId, mEventTime, mDurationSinceSessionStart,

                mDurationSincePreviousEvent, mEventIndex,

                mSessionId, mStart, mEnd, mSmartStart, mSmartEnd);

    }

core/java/android/view/textclassifier/SystemTextClassifier.java

+20 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ package android.view.textclassifier; 


import android.annotation.NonNull;

import android.annotation.Nullable;

import android.annotation.UserIdInt;

import android.annotation.WorkerThread;

import android.content.Context;

import android.os.Bundle;
@@ -50,6 +51,10 @@ public final class SystemTextClassifier implements TextClassifier { 
    private final TextClassificationConstants mSettings;

    private final TextClassifier mFallback;

    private final String mPackageName;

    // NOTE: Always set this before sending a request to the manager service otherwise the manager

    // service will throw a remote exception.

    @UserIdInt

    private final int mUserId;

    private TextClassificationSessionId mSessionId;



    public SystemTextClassifier(Context context, TextClassificationConstants settings)
@@ -60,6 +65,7 @@ public final class SystemTextClassifier implements TextClassifier { 
        mFallback = context.getSystemService(TextClassificationManager.class)

                .getTextClassifier(TextClassifier.LOCAL);

        mPackageName = Preconditions.checkNotNull(context.getOpPackageName());

        mUserId = context.getUserId();

    }



    /**
@@ -72,6 +78,7 @@ public final class SystemTextClassifier implements TextClassifier { 
        Utils.checkMainThread();

        try {

            request.setCallingPackageName(mPackageName);

            request.setUserId(mUserId);

            final BlockingCallback<TextSelection> callback =

                    new BlockingCallback<>("textselection");

            mManagerService.onSuggestSelection(mSessionId, request, callback);
@@ -95,6 +102,7 @@ public final class SystemTextClassifier implements TextClassifier { 
        Utils.checkMainThread();

        try {

            request.setCallingPackageName(mPackageName);

            request.setUserId(mUserId);

            final BlockingCallback<TextClassification> callback =

                    new BlockingCallback<>("textclassification");

            mManagerService.onClassifyText(mSessionId, request, callback);
@@ -123,6 +131,7 @@ public final class SystemTextClassifier implements TextClassifier { 


        try {

            request.setCallingPackageName(mPackageName);

            request.setUserId(mUserId);

            final BlockingCallback<TextLinks> callback =

                    new BlockingCallback<>("textlinks");

            mManagerService.onGenerateLinks(mSessionId, request, callback);
@@ -142,6 +151,7 @@ public final class SystemTextClassifier implements TextClassifier { 
        Utils.checkMainThread();



        try {

            event.setUserId(mUserId);

            mManagerService.onSelectionEvent(mSessionId, event);

        } catch (RemoteException e) {

            Log.e(LOG_TAG, "Error reporting selection event.", e);
@@ -154,6 +164,12 @@ public final class SystemTextClassifier implements TextClassifier { 
        Utils.checkMainThread();



        try {

            final TextClassificationContext tcContext = event.getEventContext() == null

                    ? new TextClassificationContext.Builder(mPackageName, WIDGET_TYPE_UNKNOWN)

                            .build()

                    : event.getEventContext();

            tcContext.setUserId(mUserId);

            event.setEventContext(tcContext);

            mManagerService.onTextClassifierEvent(mSessionId, event);

        } catch (RemoteException e) {

            Log.e(LOG_TAG, "Error reporting textclassifier event.", e);
@@ -167,6 +183,7 @@ public final class SystemTextClassifier implements TextClassifier { 


        try {

            request.setCallingPackageName(mPackageName);

            request.setUserId(mUserId);

            final BlockingCallback<TextLanguage> callback =

                    new BlockingCallback<>("textlanguage");

            mManagerService.onDetectLanguage(mSessionId, request, callback);
@@ -187,6 +204,7 @@ public final class SystemTextClassifier implements TextClassifier { 


        try {

            request.setCallingPackageName(mPackageName);

            request.setUserId(mUserId);

            final BlockingCallback<ConversationActions> callback =

                    new BlockingCallback<>("conversation-actions");

            mManagerService.onSuggestConversationActions(mSessionId, request, callback);
@@ -228,6 +246,7 @@ public final class SystemTextClassifier implements TextClassifier { 
        printWriter.printPair("mFallback", mFallback);

        printWriter.printPair("mPackageName", mPackageName);

        printWriter.printPair("mSessionId", mSessionId);

        printWriter.printPair("mUserId", mUserId);

        printWriter.decreaseIndent();

        printWriter.println();

    }
@@ -243,6 +262,7 @@ public final class SystemTextClassifier implements TextClassifier { 
            @NonNull TextClassificationSessionId sessionId) {

        mSessionId = Preconditions.checkNotNull(sessionId);

        try {

            classificationContext.setUserId(mUserId);

            mManagerService.onCreateTextClassificationSession(classificationContext, mSessionId);

        } catch (RemoteException e) {

            Log.e(LOG_TAG, "Error starting a new classification session.", e);

core/java/android/view/textclassifier/TextClassification.java

+25 −0
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ import android.annotation.IntDef; 
import android.annotation.IntRange;

import android.annotation.NonNull;

import android.annotation.Nullable;

import android.annotation.UserIdInt;

import android.app.PendingIntent;

import android.app.RemoteAction;

import android.content.Context;
@@ -35,6 +36,7 @@ import android.os.Bundle; 
import android.os.LocaleList;

import android.os.Parcel;

import android.os.Parcelable;

import android.os.UserHandle;

import android.text.SpannedString;

import android.util.ArrayMap;

import android.view.View.OnClickListener;
@@ -551,6 +553,8 @@ public final class TextClassification implements Parcelable { 
        @Nullable private final ZonedDateTime mReferenceTime;

        @NonNull private final Bundle mExtras;

        @Nullable private String mCallingPackageName;

        @UserIdInt

        private int mUserId = UserHandle.USER_NULL;



        private Request(

                CharSequence text,
@@ -630,6 +634,24 @@ public final class TextClassification implements Parcelable { 
            return mCallingPackageName;

        }



        /**

         * Sets the id of the user that sent this request.

         * <p>

         * Package-private for SystemTextClassifier's use.

         */

        void setUserId(@UserIdInt int userId) {

            mUserId = userId;

        }



        /**

         * Returns the id of the user that sent this request.

         * @hide

         */

        @UserIdInt

        public int getUserId() {

            return mUserId;

        }



        /**

         * Returns the extended data.

         *
@@ -730,6 +752,7 @@ public final class TextClassification implements Parcelable { 
            dest.writeParcelable(mDefaultLocales, flags);

            dest.writeString(mReferenceTime == null ? null : mReferenceTime.toString());

            dest.writeString(mCallingPackageName);

            dest.writeInt(mUserId);

            dest.writeBundle(mExtras);

        }
@@ -742,11 +765,13 @@ public final class TextClassification implements Parcelable { 
            final ZonedDateTime referenceTime = referenceTimeString == null

                    ? null : ZonedDateTime.parse(referenceTimeString);

            final String callingPackageName = in.readString();

            final int userId = in.readInt();

            final Bundle extras = in.readBundle();



            final Request request = new Request(text, startIndex, endIndex,

                    defaultLocales, referenceTime, extras);

            request.setCallingPackageName(callingPackageName);

            request.setUserId(userId);

            return request;

        }