Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea329372 authored by Vishnu Nair's avatar Vishnu Nair
Browse files

Validate originating process for transferTouchGesture API 

Addresses a security vulnerability where a malicious process could
potentially steal an active touch gesture from its host or embedded
process. The fix ensures that the requested is the owner of the
InputTransferToken. This adds an additional verification on top of
the existing  association checks between the transferFrom and
transferTo processes.

Flag: EXEMPT security fix
Bug: 364037868
Test: presubmit
Change-Id: I2654ccab807a62a341c8af69bf64bb33e56c4252
parent 786a3a7d

services/core/java/com/android/server/wm/EmbeddedWindowController.java

+10 −2
Original line number Diff line number Diff line
@@ -181,22 +181,30 @@ class EmbeddedWindowController { 
        return true;

    }



    boolean transferToHost(@NonNull InputTransferToken embeddedWindowToken,

    boolean transferToHost(int callingUid, @NonNull InputTransferToken embeddedWindowToken,

            @NonNull WindowState transferToHostWindowState) {

        EmbeddedWindow ew = getByInputTransferToken(embeddedWindowToken);

        if (!isValidTouchGestureParams(transferToHostWindowState, ew)) {

            return false;

        }

        if (callingUid != ew.mOwnerUid) {

            throw new SecurityException(

                    "Transfer request must originate from owner of transferFromToken");

        }

        return mInputManagerService.transferTouchGesture(ew.getInputChannelToken(),

                transferToHostWindowState.mInputChannelToken);

    }



    boolean transferToEmbedded(WindowState hostWindowState,

    boolean transferToEmbedded(int callingUid, WindowState hostWindowState,

            @NonNull InputTransferToken transferToToken) {

        final EmbeddedWindowController.EmbeddedWindow ew = getByInputTransferToken(transferToToken);

        if (!isValidTouchGestureParams(hostWindowState, ew)) {

            return false;

        }

        if (callingUid != hostWindowState.mOwnerUid) {

            throw new SecurityException(

                    "Transfer request must originate from owner of transferFromToken");

        }

        return mInputManagerService.transferTouchGesture(hostWindowState.mInputChannelToken,

                ew.getInputChannelToken());

    }

services/core/java/com/android/server/wm/WindowManagerService.java

+7 −2
Original line number Diff line number Diff line
@@ -9212,6 +9212,8 @@ public class WindowManagerService extends IWindowManager.Stub 
        final InputApplicationHandle applicationHandle;

        final String name;

        Objects.requireNonNull(outInputChannel);

        Objects.requireNonNull(inputTransferToken);



        synchronized (mGlobalLock) {

            WindowState hostWindowState = hostInputTransferToken != null

                    ? mInputToWindowMap.get(hostInputTransferToken.getToken()) : null;
@@ -9236,6 +9238,7 @@ public class WindowManagerService extends IWindowManager.Stub 
        Objects.requireNonNull(transferFromToken);

        Objects.requireNonNull(transferToToken);



        final int callingUid = Binder.getCallingUid();

        final long identity = Binder.clearCallingIdentity();

        boolean didTransfer;

        try {
@@ -9245,12 +9248,14 @@ public class WindowManagerService extends IWindowManager.Stub 
                // represents an embedded window so transfer from host to embedded.

                WindowState windowStateTo = mInputToWindowMap.get(transferToToken.getToken());

                if (windowStateTo != null) {

                    didTransfer = mEmbeddedWindowController.transferToHost(transferFromToken,

                    didTransfer = mEmbeddedWindowController.transferToHost(callingUid,

                            transferFromToken,

                            windowStateTo);

                } else {

                    WindowState windowStateFrom = mInputToWindowMap.get(

                            transferFromToken.getToken());

                    didTransfer = mEmbeddedWindowController.transferToEmbedded(windowStateFrom,

                    didTransfer = mEmbeddedWindowController.transferToEmbedded(callingUid,

                            windowStateFrom,

                            transferToToken);

                }

            }