Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f213b16e authored by Tim Yu's avatar Tim Yu Committed by Android Build Coastguard Worker
Browse files

[RESTRICT AUTOMERGE] Check permission of Autofill icon URIs 

* SaveUI's template
* Inline Suggestions slices

Fixes: b/286235483
Fixes: b/292104015

Test: atest CtsAutoFillServiceTestCases
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:bab7d3e4590ed839d1968f4bfd3ba7e8d36b3a67)
Merged-In: I48879174664b70ced90492bb0991dc91cbf89b79
Change-Id: I48879174664b70ced90492bb0991dc91cbf89b79
parent a3a504b2

services/autofill/java/com/android/server/autofill/Helper.java

+46 −2
Original line number Diff line number Diff line
@@ -25,8 +25,11 @@ import android.app.ActivityManager; 
import android.app.assist.AssistStructure;

import android.app.assist.AssistStructure.ViewNode;

import android.app.assist.AssistStructure.WindowNode;

import android.app.slice.Slice;

import android.app.slice.SliceItem;

import android.content.ComponentName;

import android.content.Context;

import android.graphics.drawable.Icon;

import android.hardware.display.DisplayManager;

import android.metrics.LogMaker;

import android.os.UserManager;
@@ -55,7 +58,6 @@ import java.util.ArrayList; 
import java.util.Arrays;

import java.util.concurrent.atomic.AtomicBoolean;





public final class Helper {



    private static final String TAG = "AutofillHelper";
@@ -93,7 +95,7 @@ public final class Helper { 
        final AtomicBoolean permissionsOk = new AtomicBoolean(true);



        rView.visitUris(uri -> {

            int uriOwnerId = android.content.ContentProvider.getUserIdFromUri(uri);

            int uriOwnerId = android.content.ContentProvider.getUserIdFromUri(uri, userId);

            boolean allowed = uriOwnerId == userId;

            permissionsOk.set(allowed && permissionsOk.get());

        });
@@ -125,6 +127,48 @@ public final class Helper { 
        return (ok ? rView : null);

    }



    /**

     * Checks the URI permissions of the icon in the slice, to see if the current userId is able to

     * access it.

     *

     * <p>Returns null if slice contains user inaccessible icons

     *

     * <p>TODO: instead of returning a null Slice when the current userId cannot access an icon,

     * return a reconstructed Slice without the icons. This is currently non-trivial since there are

     * no public methods to generically add SliceItems to Slices

     */

    public static @Nullable Slice sanitizeSlice(Slice slice) {

        if (slice == null) {

            return null;

        }



        int userId = ActivityManager.getCurrentUser();



        // Recontruct the Slice, filtering out bad icons

        for (SliceItem sliceItem : slice.getItems()) {

            if (!sliceItem.getFormat().equals(SliceItem.FORMAT_IMAGE)) {

                // Not an image slice

                continue;

            }



            Icon icon = sliceItem.getIcon();

            if (icon.getType() !=  Icon.TYPE_URI

                    && icon.getType() != Icon.TYPE_URI_ADAPTIVE_BITMAP) {

                // No URIs to sanitize

                continue;

            }



            int iconUriId = android.content.ContentProvider.getUserIdFromUri(icon.getUri(), userId);



            if (iconUriId != userId) {

                Slog.w(TAG, "sanitizeSlice() user: " + userId + " cannot access icons in Slice");

                return null;

            }

        }



        return slice;

    }





    @Nullable

    static AutofillId[] toArray(@Nullable ArraySet<AutofillId> set) {

services/autofill/java/com/android/server/autofill/ui/RemoteInlineSuggestionViewConnector.java

+14 −16
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ import android.service.autofill.InlinePresentation; 
import android.util.Slog;



import com.android.server.LocalServices;

import com.android.server.autofill.Helper;

import com.android.server.autofill.RemoteInlineSuggestionRenderService;

import com.android.server.inputmethod.InputMethodManagerInternal;
@@ -39,24 +40,17 @@ import java.util.function.Consumer; 
final class RemoteInlineSuggestionViewConnector {

    private static final String TAG = RemoteInlineSuggestionViewConnector.class.getSimpleName();



    @Nullable

    private final RemoteInlineSuggestionRenderService mRemoteRenderService;

    @NonNull

    private final InlinePresentation mInlinePresentation;

    @Nullable

    private final IBinder mHostInputToken;

    @Nullable private final RemoteInlineSuggestionRenderService mRemoteRenderService;

    @NonNull private final InlinePresentation mInlinePresentation;

    @Nullable private final IBinder mHostInputToken;

    private final int mDisplayId;

    private final int mUserId;

    private final int mSessionId;



    @NonNull

    private final Runnable mOnAutofillCallback;

    @NonNull

    private final Runnable mOnErrorCallback;

    @NonNull

    private final Runnable mOnInflateCallback;

    @NonNull

    private final Consumer<IntentSender> mStartIntentSenderFromClientApp;

    @NonNull private final Runnable mOnAutofillCallback;

    @NonNull private final Runnable mOnErrorCallback;

    @NonNull private final Runnable mOnInflateCallback;

    @NonNull private final Consumer<IntentSender> mStartIntentSenderFromClientApp;



    RemoteInlineSuggestionViewConnector(

            @NonNull InlineFillUi.InlineFillUiInfo inlineFillUiInfo,
@@ -81,8 +75,12 @@ final class RemoteInlineSuggestionViewConnector { 
     *

     * @return true if the call is made to the remote renderer service, false otherwise.

     */

    public boolean renderSuggestion(int width, int height,

            @NonNull IInlineSuggestionUiCallback callback) {

    public boolean renderSuggestion(

            int width, int height, @NonNull IInlineSuggestionUiCallback callback) {

        if (Helper.sanitizeSlice(mInlinePresentation.getSlice()) == null) {

            if (sDebug) Slog.d(TAG, "Skipped rendering inline suggestion.");

            return false;

        }

        if (mRemoteRenderService != null) {

            if (sDebug) Slog.d(TAG, "Request to recreate the UI");

            mRemoteRenderService.renderSuggestion(callback, mInlinePresentation, width, height,

services/autofill/java/com/android/server/autofill/ui/SaveUi.java

+2 −1
Original line number Diff line number Diff line
@@ -435,7 +435,8 @@ final class SaveUi { 
                    }

                    final BatchUpdates batchUpdates = pair.second;

                    // First apply the updates...

                    final RemoteViews templateUpdates = batchUpdates.getUpdates();

                    final RemoteViews templateUpdates =

                            Helper.sanitizeRemoteView(batchUpdates.getUpdates());

                    if (templateUpdates != null) {

                        if (sDebug) Slog.d(TAG, "Applying template updates for batch update #" + i);

                        templateUpdates.reapply(context, customSubtitleView);