mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
57 lines
2.3 KiB
Diff
57 lines
2.3 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Pinyao Ting <pinyaoting@google.com>
|
|
Date: Thu, 1 Jun 2023 18:12:44 -0700
|
|
Subject: [PATCH] Fix permission issue in legacy shortcut
|
|
|
|
When building legacy shortcut, Launcher calls
|
|
PackageManager#resolveActivity to retrieve necessary permission to
|
|
launch the intent.
|
|
|
|
However, when the source app wraps an arbitrary intent within
|
|
Intent#createChooser, the existing logic will fail because launching
|
|
Chooser doesn't require additional permission.
|
|
|
|
This CL fixes the security vulnerability by performing the permission
|
|
check against the intent that is wrapped within.
|
|
|
|
Bug: 270152142
|
|
Test: manual
|
|
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c53818a16b4322a823497726ac7e7a44501b4442)
|
|
Merged-In: If35344c08975e35085c7c2b9b814a3c457a144b0
|
|
Change-Id: If35344c08975e35085c7c2b9b814a3c457a144b0
|
|
---
|
|
.../launcher3/util/PackageManagerHelper.java | 13 +++++++++++++
|
|
1 file changed, 13 insertions(+)
|
|
|
|
diff --git a/src/com/android/launcher3/util/PackageManagerHelper.java b/src/com/android/launcher3/util/PackageManagerHelper.java
|
|
index 13034dd9ec..1c05c993c7 100644
|
|
--- a/src/com/android/launcher3/util/PackageManagerHelper.java
|
|
+++ b/src/com/android/launcher3/util/PackageManagerHelper.java
|
|
@@ -26,6 +26,7 @@ import android.content.pm.PackageManager.NameNotFoundException;
|
|
import android.content.pm.ResolveInfo;
|
|
import android.net.Uri;
|
|
import android.os.Build;
|
|
+import android.os.Bundle;
|
|
import android.os.UserHandle;
|
|
import android.text.TextUtils;
|
|
|
|
@@ -102,6 +103,18 @@ public class PackageManagerHelper {
|
|
* any permissions
|
|
*/
|
|
public boolean hasPermissionForActivity(Intent intent, String srcPackage) {
|
|
+ // b/270152142
|
|
+ if (Intent.ACTION_CHOOSER.equals(intent.getAction())) {
|
|
+ final Bundle extras = intent.getExtras();
|
|
+ if (extras == null) {
|
|
+ return true;
|
|
+ }
|
|
+ // If given intent is ACTION_CHOOSER, verify srcPackage has permission over EXTRA_INTENT
|
|
+ intent = (Intent) extras.getParcelable(Intent.EXTRA_INTENT);
|
|
+ if (intent == null) {
|
|
+ return true;
|
|
+ }
|
|
+ }
|
|
ResolveInfo target = mPm.resolveActivity(intent, 0);
|
|
if (target == null) {
|
|
// Not a valid target
|