Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8064a47f authored by techyminati's avatar techyminati Committed by TechyMinati
Browse files

LatinIME: Fix Implicit PendingIntent Vulnerability 



* checkTimeAndMaybeSetupUpdateAlarm method created an Implicit PendingIntent vulnerability, which may cause security threats in the form of denial-of-service, private data theft, and privilege escalation.

* PendingIntents are Intents delegated to another app to be delivered at some future time. Creating an implicit intent wrapped under a PendingIntent is a security vulnerability that might lead to denial-of-service, private data theft, and privilege escalation.

* We've used FLAG_IMMUTABLE (added in SDK 23) to create PendingIntents for SDK > 23, This prevents apps that receive the PendingIntent from filling in unpopulated properties & Ensures that PendingIntent is only delivered to trusted components.

Test: m
Change-Id: I68a1f3f2d81138e42092cc201d36e5d29853a86e
Signed-off-by: default avatartechyminati <sinha.aryan03@gmail.com>
parent 974aaeb8

java/src/com/android/inputmethod/dictionarypack/DictionaryService.java

+7 −1
Original line number Diff line number Diff line
@@ -229,8 +229,14 @@ public final class DictionaryService extends Service { 
        final long now = System.currentTimeMillis();

        final long alarmTime = now + new Random().nextInt(MAX_ALARM_DELAY_MILLIS);

        final Intent updateIntent = new Intent(DictionaryPackConstants.UPDATE_NOW_INTENT_ACTION);

        // Set the package name to ensure the PendingIntent is only delivered to trusted components

        updateIntent.setPackage(context.getPackageName());

        int pendingIntentFlags = PendingIntent.FLAG_CANCEL_CURRENT;

        if (android.os.Build.VERSION.SDK_INT >= 23) {

            pendingIntentFlags |= PendingIntent.FLAG_IMMUTABLE;

        }

        final PendingIntent pendingIntent = PendingIntent.getBroadcast(context, 0,

                updateIntent, PendingIntent.FLAG_CANCEL_CURRENT);

                updateIntent, pendingIntentFlags);



        // We set the alarm in the type that doesn't forcefully wake the device

        // from sleep, but fires the next time the device actually wakes for any