Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9d8d0cf3 authored by Grace Jia's avatar Grace Jia
Browse files

Fix security vulnerability of TelecomManager#getPhoneAccountsForPackage 

Check calling package and READ_PRIVILEGED_PHONE_STATE to avoid potential
PII expotion.

Bug: 153995334
Test: atest TelecomUnitTests:TelecomServiceImpl
Change-Id: Ie834633dc4031d19af90e922ef0f111c3c8d7cb2
parent c04659f7

src/com/android/server/telecom/TelecomServiceImpl.java

+17 −1
Original line number Original line Diff line number Diff line
@@ -56,7 +56,6 @@ import android.text.TextUtils; 
import android.util.EventLog;

import android.util.EventLog;





import com.android.internal.telecom.ITelecomService;

import com.android.internal.telecom.ITelecomService;

import com.android.internal.telephony.TelephonyPermissions;

import com.android.internal.util.IndentingPrintWriter;

import com.android.internal.util.IndentingPrintWriter;

import com.android.server.telecom.components.UserCallIntentProcessorFactory;

import com.android.server.telecom.components.UserCallIntentProcessorFactory;

import com.android.server.telecom.settings.BlockedNumbersActivity;

import com.android.server.telecom.settings.BlockedNumbersActivity;
@@ -278,6 +277,23 @@ public class TelecomServiceImpl { 




        @Override

        @Override

        public List<PhoneAccountHandle> getPhoneAccountsForPackage(String packageName) {

        public List<PhoneAccountHandle> getPhoneAccountsForPackage(String packageName) {

            //TODO: Deprecate this in S

            try {

                enforceCallingPackage(packageName);

            } catch (SecurityException se1) {

                EventLog.writeEvent(0x534e4554, "153995334", Binder.getCallingUid(),

                        "getPhoneAccountsForPackage: invalid calling package");

                throw se1;

            }



            try {

                enforcePermission(READ_PRIVILEGED_PHONE_STATE);

            } catch (SecurityException se2) {

                EventLog.writeEvent(0x534e4554, "153995334", Binder.getCallingUid(),

                        "getPhoneAccountsForPackage: no permission");

                throw se2;

            }



            synchronized (mLock) {

            synchronized (mLock) {

                final UserHandle callingUserHandle = Binder.getCallingUserHandle();

                final UserHandle callingUserHandle = Binder.getCallingUserHandle();

                long token = Binder.clearCallingIdentity();

                long token = Binder.clearCallingIdentity();