diff options
| author | 2023-11-03 23:32:33 +0000 | |
|---|---|---|
| committer | 2023-11-03 23:32:33 +0000 | |
| commit | 43bc68b84561eaaaaab464c60afb49ae5ed5f05b (patch) | |
| tree | b564977d849edb9efefdd60cd9105666684d5cc9 | |
| parent | c94352e3250836fbf80af88ce92211880ffc2b2a (diff) | |
| parent | 66864c7ac85a1efc00b5cd3bd48a72a8b62f8f89 (diff) | |
Merge "Fix vulnerability that allowed attackers to start arbitary activities" into rvc-dev am: 6b55e12830 am: eebdc4c3b6 am: 66864c7ac8
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/25238611
Change-Id: I7d3e6f6e4b16e7151d3a3863ed948d8a92057701
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
| -rw-r--r-- | packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java b/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java index ab7b54d98285..beadd821957b 100644 --- a/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java +++ b/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java @@ -351,7 +351,17 @@ public class DreamBackend { if (cn != null && cn.indexOf('/') < 0) { cn = resolveInfo.serviceInfo.packageName + "/" + cn; } - return cn == null ? null : ComponentName.unflattenFromString(cn); + // Ensure that the component is from the same package as the dream service. If not, + // treat the component as invalid and return null instead. + final ComponentName result = cn != null ? ComponentName.unflattenFromString(cn) : null; + if (result != null + && !result.getPackageName().equals(resolveInfo.serviceInfo.packageName)) { + Log.w(TAG, + "Inconsistent package name in component: " + result.getPackageName() + + ", should be: " + resolveInfo.serviceInfo.packageName); + return null; + } + return result; } private static void logd(String msg, Object... args) { |