From 2f7d50058aeb8c5e0a411d50e5bdc4b25b84de70 Mon Sep 17 00:00:00 2001 From: Makoto Onuki Date: Tue, 12 Jun 2018 13:01:42 -0700 Subject: RESTRICT AUTOMERGE: Prevent shortcut info package name spoofing Test: cts-tradefed run cts -m CtsShortcutManagerTestCases -t android.content.pm.cts.shortcutmanager.ShortcutManagerFakingPublisherTest Bug: 109824443 Change-Id: I80b2680d9c7e067f1a36fc8ad1aac1d315022a71 --- .../com/android/server/pm/ShortcutService.java | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/services/core/java/com/android/server/pm/ShortcutService.java b/services/core/java/com/android/server/pm/ShortcutService.java index 13f558e3dd13..9dfa0eabc631 100644 --- a/services/core/java/com/android/server/pm/ShortcutService.java +++ b/services/core/java/com/android/server/pm/ShortcutService.java @@ -124,6 +124,7 @@ import java.nio.charset.StandardCharsets; import java.util.ArrayList; import java.util.Collections; import java.util.List; +import java.util.Objects; import java.util.concurrent.atomic.AtomicBoolean; import java.util.function.Consumer; import java.util.function.Predicate; @@ -1514,6 +1515,24 @@ public class ShortcutService extends IShortcutService.Stub { throw new SecurityException("Calling package name mismatch"); } + private void verifyShortcutInfoPackage(String callerPackage, ShortcutInfo si) { + if (si == null) { + return; + } + if (!Objects.equals(callerPackage, si.getPackage())) { + android.util.EventLog.writeEvent(0x534e4554, "109824443", -1, ""); + throw new SecurityException("Shortcut package name mismatch"); + } + } + + private void verifyShortcutInfoPackages( + String callerPackage, List list) { + final int size = list.size(); + for (int i = 0; i < size; i++) { + verifyShortcutInfoPackage(callerPackage, list.get(i)); + } + } + // Overridden in unit tests to execute r synchronously. void injectPostToHandler(Runnable r) { mHandler.post(r); @@ -1642,6 +1661,7 @@ public class ShortcutService extends IShortcutService.Stub { verifyCaller(packageName, userId); final List newShortcuts = (List) shortcutInfoList.getList(); + verifyShortcutInfoPackages(packageName, newShortcuts); final int size = newShortcuts.size(); synchronized (mLock) { @@ -1693,6 +1713,7 @@ public class ShortcutService extends IShortcutService.Stub { verifyCaller(packageName, userId); final List newShortcuts = (List) shortcutInfoList.getList(); + verifyShortcutInfoPackages(packageName, newShortcuts); final int size = newShortcuts.size(); synchronized (mLock) { @@ -1773,6 +1794,7 @@ public class ShortcutService extends IShortcutService.Stub { verifyCaller(packageName, userId); final List newShortcuts = (List) shortcutInfoList.getList(); + verifyShortcutInfoPackages(packageName, newShortcuts); final int size = newShortcuts.size(); synchronized (mLock) { -- cgit v1.2.3-59-g8ed1b