Loading core/java/android/content/AbstractThreadedSyncAdapter.java +20 −0 Original line number Diff line number Diff line Loading @@ -21,6 +21,7 @@ import static com.android.internal.util.function.pooled.PooledLambda.obtainMessa import android.accounts.Account; import android.annotation.MainThread; import android.annotation.NonNull; import android.os.Binder; import android.os.Build; import android.os.Bundle; import android.os.Handler; Loading Loading @@ -171,8 +172,20 @@ public abstract class AbstractThreadedSyncAdapter { } private class ISyncAdapterImpl extends ISyncAdapter.Stub { private boolean isCallerSystem() { final long callingUid = Binder.getCallingUid(); if (callingUid != Process.SYSTEM_UID) { android.util.EventLog.writeEvent(0x534e4554, "203229608", -1, ""); return false; } return true; } @Override public void onUnsyncableAccount(ISyncAdapterUnsyncableAccountCallback cb) { if (!isCallerSystem()) { return; } Handler.getMain().sendMessage(obtainMessage( AbstractThreadedSyncAdapter::handleOnUnsyncableAccount, AbstractThreadedSyncAdapter.this, cb)); Loading @@ -181,12 +194,16 @@ public abstract class AbstractThreadedSyncAdapter { @Override public void startSync(ISyncContext syncContext, String authority, Account account, Bundle extras) { if (!isCallerSystem()) { return; } if (ENABLE_LOG) { if (extras != null) { extras.size(); // Unparcel so its toString() will show the contents. } Log.d(TAG, "startSync() start " + authority + " " + account + " " + extras); } try { final SyncContext syncContextClient = new SyncContext(syncContext); Loading Loading @@ -242,6 +259,9 @@ public abstract class AbstractThreadedSyncAdapter { @Override public void cancelSync(ISyncContext syncContext) { if (!isCallerSystem()) { return; } try { // synchronize to make sure that mSyncThreads doesn't change between when we // check it and when we use it Loading core/java/com/android/internal/notification/NotificationAccessConfirmationActivityContract.java +6 −4 Original line number Diff line number Diff line Loading @@ -17,6 +17,7 @@ package com.android.internal.notification; import android.content.ComponentName; import android.content.Context; import android.content.Intent; public final class NotificationAccessConfirmationActivityContract { Loading @@ -25,13 +26,14 @@ public final class NotificationAccessConfirmationActivityContract { "com.android.settings.notification.NotificationAccessConfirmationActivity"); public static final String EXTRA_USER_ID = "user_id"; public static final String EXTRA_COMPONENT_NAME = "component_name"; public static final String EXTRA_PACKAGE_TITLE = "package_title"; public static Intent launcherIntent(int userId, ComponentName component, String packageTitle) { /** * Creates a launcher intent for NotificationAccessConfirmationActivity. */ public static Intent launcherIntent(Context context, int userId, ComponentName component) { return new Intent() .setComponent(COMPONENT_NAME) .putExtra(EXTRA_USER_ID, userId) .putExtra(EXTRA_COMPONENT_NAME, component) .putExtra(EXTRA_PACKAGE_TITLE, packageTitle); .putExtra(EXTRA_COMPONENT_NAME, component); } } services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java +2 −11 Original line number Diff line number Diff line Loading @@ -43,7 +43,6 @@ import android.content.Intent; import android.content.SharedPreferences; import android.content.pm.FeatureInfo; import android.content.pm.PackageInfo; import android.content.pm.PackageItemInfo; import android.content.pm.PackageManager; import android.net.NetworkPolicyManager; import android.os.Binder; Loading Loading @@ -385,20 +384,12 @@ public class CompanionDeviceManagerService extends SystemService implements Bind String callingPackage = component.getPackageName(); checkCanCallNotificationApi(callingPackage); int userId = getCallingUserId(); String packageTitle = BidiFormatter.getInstance().unicodeWrap( getPackageInfo(callingPackage, userId) .applicationInfo .loadSafeLabel(getContext().getPackageManager(), PackageItemInfo.DEFAULT_MAX_LABEL_SIZE_PX, PackageItemInfo.SAFE_LABEL_FLAG_TRIM | PackageItemInfo.SAFE_LABEL_FLAG_FIRST_LINE) .toString()); long identity = Binder.clearCallingIdentity(); final long identity = Binder.clearCallingIdentity(); try { return PendingIntent.getActivityAsUser(getContext(), 0 /* request code */, NotificationAccessConfirmationActivityContract.launcherIntent( userId, component, packageTitle), getContext(), userId, component), PendingIntent.FLAG_IMMUTABLE | PendingIntent.FLAG_ONE_SHOT | PendingIntent.FLAG_CANCEL_CURRENT, null /* options */, Loading services/core/java/com/android/server/am/ActiveServices.java +27 −4 Original line number Diff line number Diff line Loading @@ -5005,11 +5005,17 @@ public final class ActiveServices { return true; } if (verifyPackage(callingPackage, callingUid)) { final boolean isWhiteListedPackage = mWhiteListAllowWhileInUsePermissionInFgs.contains(callingPackage); if (isWhiteListedPackage) { return true; } } else { EventLog.writeEvent(0x534e4554, "215003903", callingUid, "callingPackage:" + callingPackage + " does not belong to callingUid:" + callingUid); } // Is the calling UID a device owner app? final boolean isDeviceOwner = mAm.mInternal.isDeviceOwner(callingUid); Loading Loading @@ -5047,4 +5053,21 @@ public final class ActiveServices { r.mAllowWhileInUsePermissionInFgs = false; r.mLastSetFgsRestrictionTime = 0; } /** * Checks if a given packageName belongs to a given uid. * @param packageName the package of the caller * @param uid the uid of the caller * @return true or false */ private boolean verifyPackage(String packageName, int uid) { if (uid == ROOT_UID || uid == SYSTEM_UID) { //System and Root are always allowed return true; } final int userId = UserHandle.getUserId(uid); final int packageUid = mAm.getPackageManagerInternalLocked() .getPackageUid(packageName, PackageManager.MATCH_DEBUG_TRIAGED_MISSING, userId); return UserHandle.isSameApp(uid, packageUid); } } services/core/java/com/android/server/connectivity/PacManager.java +17 −2 Original line number Diff line number Diff line Loading @@ -37,6 +37,7 @@ import android.os.SystemClock; import android.os.SystemProperties; import android.provider.Settings; import android.util.Log; import android.webkit.URLUtil; import com.android.internal.annotations.GuardedBy; import com.android.internal.util.TrafficStatsConstants; Loading Loading @@ -215,8 +216,22 @@ public class PacManager { * @throws IOException if the URL is malformed, or the PAC file is too big. */ private static String get(Uri pacUri) throws IOException { URL url = new URL(pacUri.toString()); URLConnection urlConnection = url.openConnection(java.net.Proxy.NO_PROXY); if (!URLUtil.isValidUrl(pacUri.toString())) { throw new IOException("Malformed URL:" + pacUri); } final URL url = new URL(pacUri.toString()); URLConnection urlConnection; try { urlConnection = url.openConnection(java.net.Proxy.NO_PROXY); // Catch the possible exceptions and rethrow as IOException to not to crash the system // for illegal input. } catch (IllegalArgumentException e) { throw new IOException("Incorrect proxy type for " + pacUri); } catch (UnsupportedOperationException e) { throw new IOException("Unsupported URL connection type for " + pacUri); } long contentLength = -1; try { contentLength = Long.parseLong(urlConnection.getHeaderField("Content-Length")); Loading Loading
core/java/android/content/AbstractThreadedSyncAdapter.java +20 −0 Original line number Diff line number Diff line Loading @@ -21,6 +21,7 @@ import static com.android.internal.util.function.pooled.PooledLambda.obtainMessa import android.accounts.Account; import android.annotation.MainThread; import android.annotation.NonNull; import android.os.Binder; import android.os.Build; import android.os.Bundle; import android.os.Handler; Loading Loading @@ -171,8 +172,20 @@ public abstract class AbstractThreadedSyncAdapter { } private class ISyncAdapterImpl extends ISyncAdapter.Stub { private boolean isCallerSystem() { final long callingUid = Binder.getCallingUid(); if (callingUid != Process.SYSTEM_UID) { android.util.EventLog.writeEvent(0x534e4554, "203229608", -1, ""); return false; } return true; } @Override public void onUnsyncableAccount(ISyncAdapterUnsyncableAccountCallback cb) { if (!isCallerSystem()) { return; } Handler.getMain().sendMessage(obtainMessage( AbstractThreadedSyncAdapter::handleOnUnsyncableAccount, AbstractThreadedSyncAdapter.this, cb)); Loading @@ -181,12 +194,16 @@ public abstract class AbstractThreadedSyncAdapter { @Override public void startSync(ISyncContext syncContext, String authority, Account account, Bundle extras) { if (!isCallerSystem()) { return; } if (ENABLE_LOG) { if (extras != null) { extras.size(); // Unparcel so its toString() will show the contents. } Log.d(TAG, "startSync() start " + authority + " " + account + " " + extras); } try { final SyncContext syncContextClient = new SyncContext(syncContext); Loading Loading @@ -242,6 +259,9 @@ public abstract class AbstractThreadedSyncAdapter { @Override public void cancelSync(ISyncContext syncContext) { if (!isCallerSystem()) { return; } try { // synchronize to make sure that mSyncThreads doesn't change between when we // check it and when we use it Loading
core/java/com/android/internal/notification/NotificationAccessConfirmationActivityContract.java +6 −4 Original line number Diff line number Diff line Loading @@ -17,6 +17,7 @@ package com.android.internal.notification; import android.content.ComponentName; import android.content.Context; import android.content.Intent; public final class NotificationAccessConfirmationActivityContract { Loading @@ -25,13 +26,14 @@ public final class NotificationAccessConfirmationActivityContract { "com.android.settings.notification.NotificationAccessConfirmationActivity"); public static final String EXTRA_USER_ID = "user_id"; public static final String EXTRA_COMPONENT_NAME = "component_name"; public static final String EXTRA_PACKAGE_TITLE = "package_title"; public static Intent launcherIntent(int userId, ComponentName component, String packageTitle) { /** * Creates a launcher intent for NotificationAccessConfirmationActivity. */ public static Intent launcherIntent(Context context, int userId, ComponentName component) { return new Intent() .setComponent(COMPONENT_NAME) .putExtra(EXTRA_USER_ID, userId) .putExtra(EXTRA_COMPONENT_NAME, component) .putExtra(EXTRA_PACKAGE_TITLE, packageTitle); .putExtra(EXTRA_COMPONENT_NAME, component); } }
services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java +2 −11 Original line number Diff line number Diff line Loading @@ -43,7 +43,6 @@ import android.content.Intent; import android.content.SharedPreferences; import android.content.pm.FeatureInfo; import android.content.pm.PackageInfo; import android.content.pm.PackageItemInfo; import android.content.pm.PackageManager; import android.net.NetworkPolicyManager; import android.os.Binder; Loading Loading @@ -385,20 +384,12 @@ public class CompanionDeviceManagerService extends SystemService implements Bind String callingPackage = component.getPackageName(); checkCanCallNotificationApi(callingPackage); int userId = getCallingUserId(); String packageTitle = BidiFormatter.getInstance().unicodeWrap( getPackageInfo(callingPackage, userId) .applicationInfo .loadSafeLabel(getContext().getPackageManager(), PackageItemInfo.DEFAULT_MAX_LABEL_SIZE_PX, PackageItemInfo.SAFE_LABEL_FLAG_TRIM | PackageItemInfo.SAFE_LABEL_FLAG_FIRST_LINE) .toString()); long identity = Binder.clearCallingIdentity(); final long identity = Binder.clearCallingIdentity(); try { return PendingIntent.getActivityAsUser(getContext(), 0 /* request code */, NotificationAccessConfirmationActivityContract.launcherIntent( userId, component, packageTitle), getContext(), userId, component), PendingIntent.FLAG_IMMUTABLE | PendingIntent.FLAG_ONE_SHOT | PendingIntent.FLAG_CANCEL_CURRENT, null /* options */, Loading
services/core/java/com/android/server/am/ActiveServices.java +27 −4 Original line number Diff line number Diff line Loading @@ -5005,11 +5005,17 @@ public final class ActiveServices { return true; } if (verifyPackage(callingPackage, callingUid)) { final boolean isWhiteListedPackage = mWhiteListAllowWhileInUsePermissionInFgs.contains(callingPackage); if (isWhiteListedPackage) { return true; } } else { EventLog.writeEvent(0x534e4554, "215003903", callingUid, "callingPackage:" + callingPackage + " does not belong to callingUid:" + callingUid); } // Is the calling UID a device owner app? final boolean isDeviceOwner = mAm.mInternal.isDeviceOwner(callingUid); Loading Loading @@ -5047,4 +5053,21 @@ public final class ActiveServices { r.mAllowWhileInUsePermissionInFgs = false; r.mLastSetFgsRestrictionTime = 0; } /** * Checks if a given packageName belongs to a given uid. * @param packageName the package of the caller * @param uid the uid of the caller * @return true or false */ private boolean verifyPackage(String packageName, int uid) { if (uid == ROOT_UID || uid == SYSTEM_UID) { //System and Root are always allowed return true; } final int userId = UserHandle.getUserId(uid); final int packageUid = mAm.getPackageManagerInternalLocked() .getPackageUid(packageName, PackageManager.MATCH_DEBUG_TRIAGED_MISSING, userId); return UserHandle.isSameApp(uid, packageUid); } }
services/core/java/com/android/server/connectivity/PacManager.java +17 −2 Original line number Diff line number Diff line Loading @@ -37,6 +37,7 @@ import android.os.SystemClock; import android.os.SystemProperties; import android.provider.Settings; import android.util.Log; import android.webkit.URLUtil; import com.android.internal.annotations.GuardedBy; import com.android.internal.util.TrafficStatsConstants; Loading Loading @@ -215,8 +216,22 @@ public class PacManager { * @throws IOException if the URL is malformed, or the PAC file is too big. */ private static String get(Uri pacUri) throws IOException { URL url = new URL(pacUri.toString()); URLConnection urlConnection = url.openConnection(java.net.Proxy.NO_PROXY); if (!URLUtil.isValidUrl(pacUri.toString())) { throw new IOException("Malformed URL:" + pacUri); } final URL url = new URL(pacUri.toString()); URLConnection urlConnection; try { urlConnection = url.openConnection(java.net.Proxy.NO_PROXY); // Catch the possible exceptions and rethrow as IOException to not to crash the system // for illegal input. } catch (IllegalArgumentException e) { throw new IOException("Incorrect proxy type for " + pacUri); } catch (UnsupportedOperationException e) { throw new IOException("Unsupported URL connection type for " + pacUri); } long contentLength = -1; try { contentLength = Long.parseLong(urlConnection.getHeaderField("Content-Length")); Loading