Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit c3571dcf authored by Kevin F. Haggerty's avatar Kevin F. Haggerty
Browse files

Merge tag 'android-security-11.0.0_r70' of... 

Merge tag 'android-security-11.0.0_r70' of https://android.googlesource.com/platform/frameworks/base into staging/lineage-18.1_merge_android-security-11.0.0_r70

Android Security 11.0.0 Release 70 (10286620)

* tag 'android-security-11.0.0_r70' of https://android.googlesource.com/platform/frameworks/base:
  Resolve StatusHints image exploit across user.
  Use Settings.System.getIntForUser instead of getInt to make sure user specific settings are used
  Verify URI permissions in MediaMetadata
  Check URIs in notification public version.
  Implement visitUris for RemoteViews ViewGroupActionAdd.
  Ensure policy has no absurdly long strings
  On device lockdown, always show the keyguard
  Verify URI permissions for notification shortcutIcon.
  ActivityManagerService: Allow openContentUri from vendor/system/product.
  DO NOT MERGE: ActivityManager#killBackgroundProcesses can kill caller's own app only

Change-Id: I5a17e622e1449bb096997364ef899bed0cb50298
parents afe21856 6b61d096

core/java/android/app/ActivityManager.java

+3 −0
Original line number Diff line number Diff line
@@ -3933,6 +3933,9 @@ public class ActivityManager { 
     * processes to reclaim memory; the system will take care of restarting

     * these processes in the future as needed.

     *

     * <p class="note">Third party applications can only use this API to kill their own processes.

     * </p>

     *

     * @param packageName The name of the package whose processes are to

     * be killed.

     */

core/java/android/app/Notification.java

+27 −6
Original line number Diff line number Diff line
@@ -2476,6 +2476,14 @@ public class Notification implements Parcelable 
        }

    }



    private static void visitIconUri(@NonNull Consumer<Uri> visitor, @Nullable Icon icon) {

        if (icon == null) return;

        final int iconType = icon.getType();

        if (iconType == TYPE_URI || iconType == TYPE_URI_ADAPTIVE_BITMAP) {

            visitor.accept(icon.getUri());

        }

    }



    /**

     * Note all {@link Uri} that are referenced internally, with the expectation

     * that Uri permission grants will need to be issued to ensure the recipient
@@ -2484,6 +2492,10 @@ public class Notification implements Parcelable 
     * @hide

     */

    public void visitUris(@NonNull Consumer<Uri> visitor) {

        if (publicVersion != null) {

            publicVersion.visitUris(visitor);

        }



        visitor.accept(sound);



        if (tickerView != null) tickerView.visitUris(visitor);
@@ -2491,7 +2503,18 @@ public class Notification implements Parcelable 
        if (bigContentView != null) bigContentView.visitUris(visitor);

        if (headsUpContentView != null) headsUpContentView.visitUris(visitor);



        visitIconUri(visitor, mSmallIcon);

        visitIconUri(visitor, mLargeIcon);



        if (actions != null) {

            for (Action action : actions) {

                visitIconUri(visitor, action.getIcon());

            }

        }



        if (extras != null) {

            visitIconUri(visitor, extras.getParcelable(EXTRA_LARGE_ICON_BIG));



            visitor.accept(extras.getParcelable(EXTRA_AUDIO_CONTENTS_URI));

            if (extras.containsKey(EXTRA_BACKGROUND_IMAGE_URI)) {

                visitor.accept(Uri.parse(extras.getString(EXTRA_BACKGROUND_IMAGE_URI)));
@@ -2549,14 +2572,12 @@ public class Notification implements Parcelable 
                    }

                }

            }

        }



        if (mBubbleMetadata != null && mBubbleMetadata.getIcon() != null) {

            final Icon icon = mBubbleMetadata.getIcon();

            final int iconType = icon.getType();

            if (iconType == TYPE_URI_ADAPTIVE_BITMAP || iconType == TYPE_URI) {

                visitor.accept(icon.getUri());

            visitIconUri(visitor, extras.getParcelable(EXTRA_CONVERSATION_ICON));

        }



        if (mBubbleMetadata != null) {

            visitIconUri(visitor, mBubbleMetadata.getIcon());

        }

    }

core/java/android/app/admin/DevicePolicyManager.java

+2 −1
Original line number Diff line number Diff line
@@ -9907,7 +9907,8 @@ public class DevicePolicyManager { 














    /**















     * Called by a device admin to set the long support message. This will be displayed to the user













     * in the device administators settings screen.













     * in the device administrators settings screen. If the message is longer than 20000 characters













     * it may be truncated.















     * <p>















     * If the long support message needs to be localized, it is the responsibility of the















     * {@link DeviceAdminReceiver} to listen to the {@link Intent#ACTION_LOCALE_CHANGED} broadcast

































core/java/android/widget/RemoteViews.java



+5
−0




























Original line number
Diff line number
Diff line








@@ -1680,6 +1680,11 @@ public class RemoteViews implements Parcelable, Filter {













        public int getActionTag() {















            return VIEW_GROUP_ACTION_ADD_TAG;















        }



























        @Override













        public final void visitUris(@NonNull Consumer<Uri> visitor) {













            mNestedViews.visitUris(visitor);













        }















    }































    /**

































core/res/AndroidManifest.xml



+5
−1




























Original line number
Diff line number
Diff line








@@ -2550,6 +2550,10 @@





























    <!-- Allows an application to call















         {@link android.app.ActivityManager#killBackgroundProcesses}.



























         <p class="note">Third party applications can only use this API to kill their own













         processes.</p>





























         <p>Protection level: normal















    -->















    <permission android:name="android.permission.KILL_BACKGROUND_PROCESSES"