Fix issue with uid being passed instead of user id

- This prevents shortcut service from verifying the right user

Bug: 204932092
Test: atest DragDropControllerTests

Change-Id: Ib78d4dbf6219f6b9da05b813de739c977f414fd4

2 files changed, 31 insertions, 1 deletions

diff --git a/services/core/java/com/android/server/wm/Session.java b/services/core/java/com/android/server/wm/Session.java
index 8c056b2a43b3..d8adc512b65a 100644
--- a/services/core/java/com/android/server/wm/Session.java
+++ b/services/core/java/com/android/server/wm/Session.java
@@ -391,7 +391,7 @@ class Session extends IWindowSession.Stub implements IBinder.DeathRecipient {
                 final ShortcutServiceInternal shortcutService =
                         LocalServices.getService(ShortcutServiceInternal.class);
                 final Intent[] shortcutIntents = shortcutService.createShortcutIntents(
-                        callingUid, callingPackage, packageName, shortcutId,
+                        UserHandle.getUserId(callingUid), callingPackage, packageName, shortcutId,
                         user.getIdentifier(), callingPid, callingUid);
                 if (shortcutIntents == null || shortcutIntents.length == 0) {
                     throw new IllegalArgumentException("Invalid shortcut id");
diff --git a/services/tests/wmtests/src/com/android/server/wm/DragDropControllerTests.java b/services/tests/wmtests/src/com/android/server/wm/DragDropControllerTests.java
index a1e8ca4aa84b..32cca47b991c 100644
--- a/services/tests/wmtests/src/com/android/server/wm/DragDropControllerTests.java
+++ b/services/tests/wmtests/src/com/android/server/wm/DragDropControllerTests.java
@@ -37,6 +37,7 @@ import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.verify;
 
@@ -44,6 +45,7 @@ import android.app.PendingIntent;
 import android.content.ClipData;
 import android.content.ClipDescription;
 import android.content.Intent;
+import android.content.pm.ShortcutServiceInternal;
 import android.graphics.PixelFormat;
 import android.os.Binder;
 import android.os.IBinder;
@@ -71,6 +73,7 @@ import org.junit.Before;
 import org.junit.BeforeClass;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mockito;
 
 import java.util.ArrayList;
@@ -89,6 +92,7 @@ import java.util.concurrent.TimeUnit;
 public class DragDropControllerTests extends WindowTestsBase {
     private static final int TIMEOUT_MS = 3000;
     private static final int TEST_UID = 12345;
+    private static final int TEST_PROFILE_UID = 12345 * UserHandle.PER_USER_RANGE;
     private static final int TEST_PID = 67890;
     private static final String TEST_PACKAGE = "com.test.package";
 
@@ -387,6 +391,32 @@ public class DragDropControllerTests extends WindowTestsBase {
         }
     }
 
+    @Test
+    public void testValidateProfileAppShortcutArguments_notCallingUid() {
+        doReturn(PERMISSION_GRANTED).when(mWm.mContext)
+                .checkCallingOrSelfPermission(eq(START_TASKS_FROM_RECENTS));
+        final Session session = Mockito.spy(new Session(mWm, new IWindowSessionCallback.Stub() {
+            @Override
+            public void onAnimatorScaleChanged(float scale) {}
+        }));
+        final ShortcutServiceInternal shortcutService = mock(ShortcutServiceInternal.class);
+        final Intent[] shortcutIntents = new Intent[1];
+        shortcutIntents[0] = new Intent();
+        doReturn(shortcutIntents).when(shortcutService).createShortcutIntents(anyInt(), any(),
+                any(), any(), anyInt(), anyInt(), anyInt());
+        LocalServices.removeServiceForTest(ShortcutServiceInternal.class);
+        LocalServices.addService(ShortcutServiceInternal.class, shortcutService);
+
+        ArgumentCaptor<Integer> callingUser = ArgumentCaptor.forClass(Integer.class);
+        session.validateAndResolveDragMimeTypeExtras(
+                createClipDataForShortcut("test_package", "test_shortcut_id",
+                        mock(UserHandle.class)),
+                TEST_PROFILE_UID, TEST_PID, TEST_PACKAGE);
+        verify(shortcutService).createShortcutIntents(callingUser.capture(), any(),
+                any(), any(), anyInt(), anyInt(), anyInt());
+        assertTrue(callingUser.getValue() == UserHandle.getUserId(TEST_PROFILE_UID));
+    }
+
     private ClipData createClipDataForShortcut(String packageName, String shortcutId,
             UserHandle user) {
         final Intent data = new Intent();