Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c6dbcc13 authored by Atanas Kirilov's avatar Atanas Kirilov Committed by Android (Google) Code Review
Browse files

Merge "Backport Prevent shortcut info package name spoofing" into oc-dev

parents 000036eb 9e21579a

services/core/java/com/android/server/pm/ShortcutService.java

+24 −0
Original line number Diff line number Diff line
@@ -131,6 +131,7 @@ import java.nio.charset.StandardCharsets; 
import java.util.ArrayList;

import java.util.Collections;

import java.util.List;

import java.util.Objects;

import java.util.concurrent.atomic.AtomicBoolean;

import java.util.function.Consumer;

import java.util.function.Predicate;
@@ -1526,6 +1527,24 @@ public class ShortcutService extends IShortcutService.Stub { 
                "Ephemeral apps can't use ShortcutManager");

    }



    private void verifyShortcutInfoPackage(String callerPackage, ShortcutInfo si) {

        if (si == null) {

            return;

        }

        if (!Objects.equals(callerPackage, si.getPackage())) {

            android.util.EventLog.writeEvent(0x534e4554, "109824443", -1, "");

            throw new SecurityException("Shortcut package name mismatch");

        }

    }



    private void verifyShortcutInfoPackages(

            String callerPackage, List<ShortcutInfo> list) {

        final int size = list.size();

        for (int i = 0; i < size; i++) {

            verifyShortcutInfoPackage(callerPackage, list.get(i));

        }

    }



    // Overridden in unit tests to execute r synchronously.

    void injectPostToHandler(Runnable r) {

        mHandler.post(r);
@@ -1673,6 +1692,7 @@ public class ShortcutService extends IShortcutService.Stub { 
        verifyCaller(packageName, userId);



        final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();

        verifyShortcutInfoPackages(packageName, newShortcuts);

        final int size = newShortcuts.size();



        synchronized (mLock) {
@@ -1724,6 +1744,7 @@ public class ShortcutService extends IShortcutService.Stub { 
        verifyCaller(packageName, userId);



        final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();

        verifyShortcutInfoPackages(packageName, newShortcuts);

        final int size = newShortcuts.size();



        synchronized (mLock) {
@@ -1804,6 +1825,7 @@ public class ShortcutService extends IShortcutService.Stub { 
        verifyCaller(packageName, userId);



        final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();

        verifyShortcutInfoPackages(packageName, newShortcuts);

        final int size = newShortcuts.size();



        synchronized (mLock) {
@@ -1863,6 +1885,7 @@ public class ShortcutService extends IShortcutService.Stub { 
        Preconditions.checkNotNull(shortcut);

        Preconditions.checkArgument(shortcut.isEnabled(), "Shortcut must be enabled");

        verifyCaller(packageName, userId);

        verifyShortcutInfoPackage(packageName, shortcut);



        final Intent ret;

        synchronized (mLock) {
@@ -1884,6 +1907,7 @@ public class ShortcutService extends IShortcutService.Stub { 
    private boolean requestPinItem(String packageName, int userId, ShortcutInfo shortcut,

            AppWidgetProviderInfo appWidget, Bundle extras, IntentSender resultIntent) {

        verifyCaller(packageName, userId);

        verifyShortcutInfoPackage(packageName, shortcut);



        final boolean ret;

        synchronized (mLock) {