Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f77a46ef authored by tonihei's avatar tonihei
Browse files

Add flag to exclude capability propagation when connecting MediaBrowser 

Also assume this flag is true when EXTRA_RECENT is used as querying
the recent playback should always only be a one-off short lived request

Bug: 393582077
Test: Verified exploit in b/393582077 is no longer working
Flag: com.android.media.mediasession.flags.avoid_media_browser_include_capabilities_if_not_needed
Change-Id: I7eba9d23897dc3664acc34f72672f98f99811623
parent f5f729eb

media/java/android/media/browse/MediaBrowser.java

+13 −1
Original line number Diff line number Diff line
@@ -42,6 +42,8 @@ import android.text.TextUtils; 
import android.util.ArrayMap;

import android.util.Log;



import com.android.media.mediasession.flags.Flags;



import java.lang.annotation.Retention;

import java.lang.annotation.RetentionPolicy;

import java.lang.ref.WeakReference;
@@ -463,7 +465,17 @@ public final class MediaBrowser { 


        boolean bound = false;

        try {

            int bindServiceFlags = Context.BIND_AUTO_CREATE | Context.BIND_INCLUDE_CAPABILITIES;

            int bindServiceFlags;

            if (Flags.avoidMediaBrowserIncludeCapabilitiesIfNotNeeded()) {

                bindServiceFlags = Context.BIND_AUTO_CREATE;

                if (mRootHints == null

                        || (!mRootHints.containsKey(BrowserRoot.EXTRA_EXCLUDE_CAPABILITIES)

                                && !mRootHints.containsKey(BrowserRoot.EXTRA_RECENT))) {

                    bindServiceFlags |= Context.BIND_INCLUDE_CAPABILITIES;

                }

            } else {

                bindServiceFlags = Context.BIND_AUTO_CREATE | Context.BIND_INCLUDE_CAPABILITIES;

            }

            bound = mContext.bindService(intent, mServiceConnection, bindServiceFlags);

        } catch (Exception ex) {

            Log.e(TAG, "Failed binding to service " + mServiceComponent);

media/java/android/service/media/MediaBrowserService.java

+12 −0
Original line number Diff line number Diff line
@@ -607,6 +607,18 @@ public abstract class MediaBrowserService extends Service { 
         */

        public static final String EXTRA_SUGGESTED = "android.service.media.extra.SUGGESTED";



        /**

         * A key for the root hint when connecting a browser to indicate that the bind connection

         * should not include capabilities.

         *

         * <p>When using {@link #EXTRA_RECENT}, this flag is assumed to be set as well.

         *

         * @see android.content.Context#BIND_INCLUDE_CAPABILITIES

         * @hide

         */

        public static final String EXTRA_EXCLUDE_CAPABILITIES =

                "android.service.media.extra.EXCLUDE_CAPABILITIES";



        private final String mRootId;

        private final Bundle mExtras;