Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 37355ed7 authored by Siarhei Vishniakou's avatar Siarhei Vishniakou Committed by Automerger Merge Worker
Browse files

Prevent targeted injection into non-owned windows am: 580fb3af 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/native/+/23066116



Change-Id: I8c0869c5320cbb04b71a3b655d9e20f3445ca54b
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents ac7b2044 580fb3af

services/inputflinger/dispatcher/InputDispatcher.cpp

+13 −6
Original line number Diff line number Diff line
@@ -2579,11 +2579,6 @@ std::vector<InputTarget> InputDispatcher::findTouchedWindowTargetsLocked( 
    if (entry.injectionState != nullptr) {

        std::string errs;

        for (const TouchedWindow& touchedWindow : tempTouchState.windows) {

            if (touchedWindow.targetFlags.test(InputTarget::Flags::DISPATCH_AS_OUTSIDE)) {

                // Allow ACTION_OUTSIDE events generated by targeted injection to be

                // dispatched to any uid, since the coords will be zeroed out later.

                continue;

            }

            const auto err = verifyTargetedInjection(touchedWindow.windowHandle, entry);

            if (err) errs += "\n  - " + *err;

        }
@@ -2636,6 +2631,18 @@ std::vector<InputTarget> InputDispatcher::findTouchedWindowTargetsLocked( 
                              targets);

    }



    // During targeted injection, only allow owned targets to receive events

    std::erase_if(targets, [&](const InputTarget& target) {

        LOG_ALWAYS_FATAL_IF(target.windowHandle == nullptr);

        const auto err = verifyTargetedInjection(target.windowHandle, entry);

        if (err) {

            LOG(WARNING) << "Dropping injected event from " << target.windowHandle->getName()

                         << ": " << (*err);

            return true;

        }

        return false;

    });



    if (targets.empty()) {

        LOG(INFO) << "Dropping event because no targets were found: " << entry.getDescription();

        outInjectionResult = InputEventInjectionResult::FAILED;
@@ -2838,7 +2845,7 @@ std::optional<InputTarget> InputDispatcher::createInputTargetLocked( 
    if (displayInfoIt != mDisplayInfos.end()) {

        inputTarget.displayTransform = displayInfoIt->second.transform;

    } else {

        // DisplayInfo not found for this window on display windowInfo->displayId.

        // DisplayInfo not found for this window on display windowHandle->getInfo()->displayId.

        // TODO(b/198444055): Make this an error message after 'setInputWindows' API is removed.

    }

    return inputTarget;

services/inputflinger/tests/InputDispatcher_test.cpp

+3 −3
Original line number Diff line number Diff line
@@ -9777,7 +9777,7 @@ TEST_F(InputDispatcherTargetedInjectionTest, CanInjectIntoAnyWindowWhenNotTarget 
    window->assertNoEvents();

}



TEST_F(InputDispatcherTargetedInjectionTest, CanGenerateActionOutsideToOtherUids) {

TEST_F(InputDispatcherTargetedInjectionTest, CannotGenerateActionOutsideToOtherUids) {

    auto owner = User(mDispatcher, 10, 11);

    auto window = owner.createWindow();
@@ -9787,11 +9787,11 @@ TEST_F(InputDispatcherTargetedInjectionTest, CanGenerateActionOutsideToOtherUids 
    randosWindow->setWatchOutsideTouch(true);

    mDispatcher->setInputWindows({{ADISPLAY_ID_DEFAULT, {randosWindow, window}}});



    // We allow generation of ACTION_OUTSIDE events into windows owned by different uids.

    // Do not allow generation of ACTION_OUTSIDE events into windows owned by different uids.

    EXPECT_EQ(InputEventInjectionResult::SUCCEEDED,

              owner.injectTargetedMotion(AMOTION_EVENT_ACTION_DOWN));

    window->consumeMotionDown();

    randosWindow->consumeMotionOutside();

    randosWindow->assertNoEvents();

}



} // namespace android::inputdispatcher