Merge "Preventing component spoofing during getShortcutIntent" into sc-dev (f59889a0) · Commits · e / os / android_frameworks_base

core/java/android/app/ActivityManagerInternal.java

+8 −0

Original line number	Diff line number	Diff line
		@@ -603,6 +603,14 @@ public abstract class ActivityManagerInternal {
		int requestCode, @NonNull Intent intent, int flags, Bundle options,
		String ownerPkgName, int ownerUid);

		/**
		* Effectively PendingIntent.getActivityForUser(), but the PendingIntent is
		* owned by the given uid rather than by the caller (i.e. the system).
		*/
		public abstract PendingIntent getPendingIntentActivityAsApp(
		int requestCode, @NonNull Intent[] intents, int flags, Bundle options,
		String ownerPkgName, int ownerUid);

		/**
		* @return mBootTimeTempAllowlistDuration of ActivityManagerConstants.
		*/

services/core/java/com/android/server/am/ActivityManagerService.java

+19 −5

Original line number	Diff line number	Diff line
		@@ -16178,6 +16178,14 @@ public class ActivityManagerService extends IActivityManager.Stub
		public PendingIntent getPendingIntentActivityAsApp(
		int requestCode, @NonNull Intent intent, int flags, Bundle options,
		String ownerPkg, int ownerUid) {
		return getPendingIntentActivityAsApp(requestCode, new Intent[] { intent }, flags,
		options, ownerPkg, ownerUid);
		}

		@Override
		public PendingIntent getPendingIntentActivityAsApp(
		int requestCode, @NonNull Intent[] intents, int flags, Bundle options,
		String ownerPkg, int ownerUid) {
		// system callers must explicitly set mutability state
		final boolean flagImmutableSet = (flags & PendingIntent.FLAG_IMMUTABLE) != 0;
		final boolean flagMutableSet = (flags & PendingIntent.FLAG_MUTABLE) != 0;
		@@ -16187,15 +16195,21 @@ public class ActivityManagerService extends IActivityManager.Stub
		}

		final Context context = ActivityManagerService.this.mContext;
		String resolvedType = intent.resolveTypeIfNeeded(context.getContentResolver());
		final ContentResolver resolver = context.getContentResolver();
		final int len = intents.length;
		final String[] resolvedTypes = new String[len];
		for (int i = 0; i < len; i++) {
		final Intent intent = intents[i];
		resolvedTypes[i] = intent.resolveTypeIfNeeded(resolver);
		intent.migrateExtraStreamToClipData(context);
		intent.prepareToLeaveProcess(context);
		}
		IIntentSender target =
		ActivityManagerService.this.getIntentSenderWithFeatureAsApp(
		INTENT_SENDER_ACTIVITY, ownerPkg,
		context.getAttributionTag(), null, null, requestCode,
		new Intent[] { intent },
		resolvedType != null ? new String[] { resolvedType } : null,
		intents,
		resolvedTypes,
		flags, options, UserHandle.getUserId(ownerUid), ownerUid);
		return target != null ? new PendingIntent(target) : null;
		}

services/core/java/com/android/server/pm/LauncherAppsService.java

+8 −9

Original line number	Diff line number	Diff line
		@@ -698,14 +698,13 @@ public class LauncherAppsService extends SystemService {
		}
		final long ident = Binder.clearCallingIdentity();
		try {
		return injectCreatePendingIntent(mContext.createPackageContextAsUser(packageName,
		0, user), 0 /* requestCode */, intents, FLAG_MUTABLE, opts, user);
		} catch (PackageManager.NameNotFoundException e) {
		Slog.e(TAG, "Cannot create pending intent from shortcut " + shortcutId, e);
		return injectCreatePendingIntent(0 /* requestCode */, intents,
		FLAG_MUTABLE, opts, packageName, mPackageManagerInternal.getPackageUid(
		packageName, PackageManager.MATCH_DIRECT_BOOT_AUTO,
		user.getIdentifier()));
		} finally {
		Binder.restoreCallingIdentity(ident);
		}
		return null;
		}

		@Override
		@@ -812,10 +811,10 @@ public class LauncherAppsService extends SystemService {
		}

		@VisibleForTesting
		PendingIntent injectCreatePendingIntent(Context context, int requestCode,
		@NonNull Intent[] intents, int flags, Bundle options, UserHandle user) {
		return PendingIntent.getActivitiesAsUser(context, requestCode, intents, flags, options,
		user);
		PendingIntent injectCreatePendingIntent(int requestCode, @NonNull Intent[] intents,
		int flags, Bundle options, String ownerPackage, int ownerUserId) {
		return mActivityManagerInternal.getPendingIntentActivityAsApp(requestCode, intents,
		flags, options, ownerPackage, ownerUserId);
		}

		@Override

services/tests/servicestests/src/com/android/server/pm/BaseShortcutManagerTest.java

+2 −2

Original line number	Diff line number	Diff line
		@@ -635,8 +635,8 @@ public abstract class BaseShortcutManagerTest extends InstrumentationTestCase {
		}

		@Override
		PendingIntent injectCreatePendingIntent(Context context, int requestCode,
		@NonNull Intent[] intents, int flags, Bundle options, UserHandle user) {
		PendingIntent injectCreatePendingIntent(int requestCode, @NonNull Intent[] intents,
		int flags, Bundle options, String ownerPackage, int ownerUserId) {
		return new PendingIntent(mock(IIntentSender.class));
		}
		}