Merge "[Ongoing Call] Don't call #getIntent to avoid a security vulnerability." into tm-dev (d2b71396) · Commits · e / os / android_frameworks_base

packages/SystemUI/src/com/android/systemui/statusbar/phone/ongoingcall/OngoingCallController.kt

+3 −4

Original line number	Diff line number	Diff line
		@@ -21,8 +21,8 @@ import android.app.IActivityManager
		import android.app.IUidObserver
		import android.app.Notification
		import android.app.Notification.CallStyle.CALL_TYPE_ONGOING
		import android.app.PendingIntent
		import android.content.Context
		import android.content.Intent
		import android.util.Log
		import android.view.View
		import androidx.annotation.VisibleForTesting
		@@ -95,7 +95,7 @@ class OngoingCallController @Inject constructor(
		val newOngoingCallInfo = CallNotificationInfo(
		entry.sbn.key,
		entry.sbn.notification.`when`,
		entry.sbn.notification.contentIntent?.intent,
		entry.sbn.notification.contentIntent,
		entry.sbn.uid,
		entry.sbn.notification.extras.getInt(
		Notification.EXTRA_CALL_TYPE, -1) == CALL_TYPE_ONGOING,
		@@ -227,7 +227,6 @@ class OngoingCallController @Inject constructor(
		logger.logChipClicked()
		activityStarter.postStartActivityDismissingKeyguard(
		intent,
		0,
		ActivityLaunchAnimator.Controller.fromView(
		backgroundView,
		InteractionJankMonitor.CUJ_STATUS_BAR_APP_LAUNCH_FROM_CALL_CHIP)
		@@ -301,7 +300,7 @@ class OngoingCallController @Inject constructor(
		private data class CallNotificationInfo(
		val key: String,
		val callStartTime: Long,
		val intent: Intent?,
		val intent: PendingIntent?,
		val uid: Int,
		/** True if the call is currently ongoing (as opposed to incoming, screening, etc.). */
		val isOngoing: Boolean,

+13 −2

Original line number	Diff line number	Diff line
		@@ -22,7 +22,6 @@ import android.app.IUidObserver
		import android.app.Notification
		import android.app.PendingIntent
		import android.app.Person
		import android.content.Intent
		import android.service.notification.NotificationListenerService.REASON_USER_STOPPED
		import android.testing.AndroidTestingRunner
		import android.testing.TestableLooper
		@@ -460,6 +459,19 @@ class OngoingCallControllerTest : SysuiTestCase() {
		.isEqualTo(OngoingCallLogger.OngoingCallEvents.ONGOING_CALL_CLICKED.id)
		}

		/** Regression test for b/212467440. */
		@Test
		fun chipClicked_activityStarterTriggeredWithUnmodifiedIntent() {
		val notifEntry = createOngoingCallNotifEntry()
		val pendingIntent = notifEntry.sbn.notification.contentIntent
		notifCollectionListener.onEntryUpdated(notifEntry)

		chipView.performClick()

		// Ensure that the sysui didn't modify the notification's intent -- see b/212467440.
		verify(mockActivityStarter).postStartActivityDismissingKeyguard(eq(pendingIntent), any())
		}

		@Test
		fun notifyChipVisibilityChanged_visibleEventLogged() {
		controller.notifyChipVisibilityChanged(true)
		@@ -601,7 +613,6 @@ class OngoingCallControllerTest : SysuiTestCase() {
		notificationEntryBuilder.modifyNotification(context).setContentIntent(null)
		} else {
		val contentIntent = mock(PendingIntent::class.java)
		`when`(contentIntent.intent).thenReturn(mock(Intent::class.java))
		notificationEntryBuilder.modifyNotification(context).setContentIntent(contentIntent)
		}