Skip to content

Commit 197a074

Browse files
author
Android Build Coastguard Worker
committed
Merge cherrypicks of [15541536, 15541590, 15541500, 15541501, 15541502, 15541503, 15541504, 15541505, 15541611, 15541508, 15541612, 15541591, 15541265, 15541266, 15541267, 15541614, 15541593] into security-aosp-rvc-release
Change-Id: I29a0e3961cb048c9eee8a05c4cb8f4af36a491c9
2 parents 54a83a8 + 6ea366b commit 197a074

11 files changed

Lines changed: 103 additions & 17 deletions

File tree

‎core/java/android/app/Notification.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3028,6 +3028,19 @@ public void setLatestEventInfo(Context context,
30283028
builder.build(); // callers expect this notification to be ready to use
30293029
}
30303030

3031+
/**
3032+
* Sets the token used for background operations for the pending intents associated with this
3033+
* notification.
3034+
*
3035+
* This token is automatically set during deserialization for you, you usually won't need to
3036+
* call this unless you want to change the existing token, if any.
3037+
*
3038+
* @hide
3039+
*/
3040+
public void setAllowlistToken(@Nullable IBinder token) {
3041+
mWhitelistToken = token;
3042+
}
3043+
30313044
/**
30323045
* @hide
30333046
*/

‎core/java/android/content/pm/PackageItemInfo.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,9 @@ public PackageItemInfo(PackageItemInfo orig) {
207207
return loadSafeLabel(pm, DEFAULT_MAX_LABEL_SIZE_PX, SAFE_STRING_FLAG_TRIM
208208
| SAFE_STRING_FLAG_FIRST_LINE);
209209
} else {
210-
return loadUnsafeLabel(pm);
210+
// Trims the label string to the MAX_SAFE_LABEL_LENGTH. This is to prevent that the
211+
// system is overwhelmed by an enormous string returned by the application.
212+
return TextUtils.trimToSize(loadUnsafeLabel(pm), MAX_SAFE_LABEL_LENGTH);
211213
}
212214
}
213215

‎core/res/res/values/strings.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3780,6 +3780,8 @@
37803780
<string name="deny">Deny</string>
37813781
<string name="permission_request_notification_title">Permission requested</string>
37823782
<string name="permission_request_notification_with_subtitle">Permission requested\nfor account <xliff:g id="account" example="foo@gmail.com">%s</xliff:g>.</string>
3783+
<!-- Title and subtitle for notification shown when app request account access (two lines) [CHAR LIMIT=NONE] -->
3784+
<string name="permission_request_notification_for_app_with_subtitle">Permission requested by <xliff:g id="app" example="Gmail">%1$s</xliff:g>\nfor account <xliff:g id="account" example="foo@gmail.com">%2$s</xliff:g>.</string>
37833785

37843786
<!-- Message to show when an intent automatically switches users into the personal profile. -->
37853787
<string name="forward_intent_to_owner">You\'re using this app outside of your work profile</string>

‎core/res/res/values/symbols.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -548,6 +548,7 @@
548548
<java-symbol type="string" name="notification_title" />
549549
<java-symbol type="string" name="other_networks_no_internet" />
550550
<java-symbol type="string" name="permission_request_notification_with_subtitle" />
551+
<java-symbol type="string" name="permission_request_notification_for_app_with_subtitle" />
551552
<java-symbol type="string" name="prepend_shortcut_label" />
552553
<java-symbol type="string" name="private_dns_broken_detailed" />
553554
<java-symbol type="string" name="paste_as_plain_text" />

‎graphics/java/android/graphics/drawable/VectorDrawable.java‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -348,15 +348,19 @@ public class VectorDrawable extends Drawable {
348348
private final Rect mTmpBounds = new Rect();
349349

350350
public VectorDrawable() {
351-
this(new VectorDrawableState(null), null);
351+
this(null, null);
352352
}
353353

354354
/**
355355
* The one constructor to rule them all. This is called by all public
356356
* constructors to set the state and initialize local properties.
357357
*/
358-
private VectorDrawable(@NonNull VectorDrawableState state, @Nullable Resources res) {
359-
mVectorState = state;
358+
private VectorDrawable(@Nullable VectorDrawableState state, @Nullable Resources res) {
359+
// As the mutable, not-thread-safe native instance is stored in VectorDrawableState, we
360+
// need to always do a defensive copy even if mutate() isn't called. Otherwise
361+
// draw() being called on 2 different VectorDrawable instances could still hit the same
362+
// underlying native object.
363+
mVectorState = new VectorDrawableState(state);
360364
updateLocalState(res);
361365
}
362366

‎packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,9 +195,12 @@ private void startListening() {
195195
filter.addAction(Intent.ACTION_PACKAGE_CHANGED);
196196
filter.addAction(Intent.ACTION_PACKAGE_REPLACED);
197197
filter.addAction(Intent.ACTION_PACKAGE_REMOVED);
198+
filter.addDataScheme("package");
199+
mContext.registerReceiver(this, filter);
198200
filter.addAction(PLUGIN_CHANGED);
199201
filter.addAction(DISABLE_PLUGIN);
200202
filter.addDataScheme("package");
203+
mContext.registerReceiver(this, filter, PluginInstanceManager.PLUGIN_PERMISSION, null);
201204
mContext.registerReceiver(this, filter);
202205
filter = new IntentFilter(Intent.ACTION_USER_UNLOCKED);
203206
mContext.registerReceiver(this, filter);

‎services/core/java/com/android/server/ConnectivityService.java‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@
7373
import android.content.Intent;
7474
import android.content.IntentFilter;
7575
import android.content.pm.PackageManager;
76+
import android.content.pm.PackageManager.NameNotFoundException;
7677
import android.content.res.Configuration;
7778
import android.database.ContentObserver;
7879
import android.net.CaptivePortal;
@@ -4607,6 +4608,25 @@ public void deleteVpnProfile(@NonNull String packageName) {
46074608
}
46084609
}
46094610

4611+
private int getAppUid(final String app, final int userId) {
4612+
final PackageManager pm = mContext.getPackageManager();
4613+
final long token = Binder.clearCallingIdentity();
4614+
try {
4615+
return pm.getPackageUidAsUser(app, userId);
4616+
} catch (NameNotFoundException e) {
4617+
return -1;
4618+
} finally {
4619+
Binder.restoreCallingIdentity(token);
4620+
}
4621+
}
4622+
4623+
private void verifyCallingUidAndPackage(String packageName, int callingUid) {
4624+
final int userId = UserHandle.getUserId(callingUid);
4625+
if (getAppUid(packageName, userId) != callingUid) {
4626+
throw new SecurityException(packageName + " does not belong to uid " + callingUid);
4627+
}
4628+
}
4629+
46104630
/**
46114631
* Starts the VPN based on the stored profile for the given package
46124632
*
@@ -4618,7 +4638,9 @@ public void deleteVpnProfile(@NonNull String packageName) {
46184638
*/
46194639
@Override
46204640
public void startVpnProfile(@NonNull String packageName) {
4621-
final int user = UserHandle.getUserId(Binder.getCallingUid());
4641+
final int callingUid = Binder.getCallingUid();
4642+
verifyCallingUidAndPackage(packageName, callingUid);
4643+
final int user = UserHandle.getUserId(callingUid);
46224644
synchronized (mVpns) {
46234645
throwIfLockdownEnabled();
46244646
mVpns.get(user).startVpnProfile(packageName, mKeyStore);
@@ -4635,7 +4657,9 @@ public void startVpnProfile(@NonNull String packageName) {
46354657
*/
46364658
@Override
46374659
public void stopVpnProfile(@NonNull String packageName) {
4638-
final int user = UserHandle.getUserId(Binder.getCallingUid());
4660+
final int callingUid = Binder.getCallingUid();
4661+
verifyCallingUidAndPackage(packageName, callingUid);
4662+
final int user = UserHandle.getUserId(callingUid);
46394663
synchronized (mVpns) {
46404664
mVpns.get(user).stopVpnProfile(packageName);
46414665
}

‎services/core/java/com/android/server/accounts/AccountManagerService.java‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,7 @@ private void cancelAccountAccessRequestNotificationIfNeeded(Account account,
449449
if (!checkAccess || hasAccountAccess(account, packageName,
450450
UserHandle.getUserHandleForUid(uid))) {
451451
cancelNotification(getCredentialPermissionNotificationId(account,
452-
AccountManager.ACCOUNT_ACCESS_TOKEN_TYPE, uid), packageName,
452+
AccountManager.ACCOUNT_ACCESS_TOKEN_TYPE, uid),
453453
UserHandle.getUserHandleForUid(uid));
454454
}
455455
}
@@ -3051,8 +3051,8 @@ private void createNoCredentialsPermissionNotification(Account account, Intent i
30513051
String authTokenType = intent.getStringExtra(
30523052
GrantCredentialsPermissionActivity.EXTRAS_AUTH_TOKEN_TYPE);
30533053
final String titleAndSubtitle =
3054-
mContext.getString(R.string.permission_request_notification_with_subtitle,
3055-
account.name);
3054+
mContext.getString(R.string.permission_request_notification_for_app_with_subtitle,
3055+
getApplicationLabel(packageName), account.name);
30563056
final int index = titleAndSubtitle.indexOf('\n');
30573057
String title = titleAndSubtitle;
30583058
String subtitle = "";
@@ -3074,7 +3074,16 @@ private void createNoCredentialsPermissionNotification(Account account, Intent i
30743074
PendingIntent.FLAG_CANCEL_CURRENT, null, user))
30753075
.build();
30763076
installNotification(getCredentialPermissionNotificationId(
3077-
account, authTokenType, uid), n, packageName, user.getIdentifier());
3077+
account, authTokenType, uid), n, "android", user.getIdentifier());
3078+
}
3079+
3080+
private String getApplicationLabel(String packageName) {
3081+
try {
3082+
return mPackageManager.getApplicationLabel(
3083+
mPackageManager.getApplicationInfo(packageName, 0)).toString();
3084+
} catch (PackageManager.NameNotFoundException e) {
3085+
return packageName;
3086+
}
30783087
}
30793088

30803089
private Intent newGrantCredentialsPermissionIntent(Account account, String packageName,
@@ -3110,7 +3119,7 @@ private NotificationId getCredentialPermissionNotificationId(Account account,
31103119
nId = accounts.credentialsPermissionNotificationIds.get(key);
31113120
if (nId == null) {
31123121
String tag = TAG + ":" + SystemMessage.NOTE_ACCOUNT_CREDENTIAL_PERMISSION
3113-
+ ":" + account.hashCode() + ":" + authTokenType.hashCode();
3122+
+ ":" + account.hashCode() + ":" + authTokenType.hashCode() + ":" + uid;
31143123
int id = SystemMessage.NOTE_ACCOUNT_CREDENTIAL_PERMISSION;
31153124
nId = new NotificationId(tag, id);
31163125
accounts.credentialsPermissionNotificationIds.put(key, nId);
@@ -4063,7 +4072,7 @@ public void onError(int errorCode, String errorMessage) throws RemoteException {
40634072

40644073
private void handleAuthenticatorResponse(boolean accessGranted) throws RemoteException {
40654074
cancelNotification(getCredentialPermissionNotificationId(account,
4066-
AccountManager.ACCOUNT_ACCESS_TOKEN_TYPE, uid), packageName,
4075+
AccountManager.ACCOUNT_ACCESS_TOKEN_TYPE, uid),
40674076
UserHandle.getUserHandleForUid(uid));
40684077
if (callback != null) {
40694078
Bundle result = new Bundle();

‎services/core/java/com/android/server/net/NetworkPolicyManagerService.java‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1362,7 +1362,8 @@ private void enqueueNotification(NetworkPolicy policy, int type, long totalBytes
13621362

13631363
builder.setSmallIcon(R.drawable.stat_notify_error);
13641364

1365-
final Intent snoozeIntent = buildSnoozeWarningIntent(policy.template);
1365+
final Intent snoozeIntent = buildSnoozeWarningIntent(policy.template,
1366+
mContext.getPackageName());
13661367
builder.setDeleteIntent(PendingIntent.getBroadcast(
13671368
mContext, 0, snoozeIntent, PendingIntent.FLAG_UPDATE_CURRENT));
13681369

@@ -1448,7 +1449,8 @@ private void enqueueNotification(NetworkPolicy policy, int type, long totalBytes
14481449

14491450
builder.setSmallIcon(R.drawable.stat_notify_error);
14501451

1451-
final Intent snoozeIntent = buildSnoozeRapidIntent(policy.template);
1452+
final Intent snoozeIntent = buildSnoozeRapidIntent(policy.template,
1453+
mContext.getPackageName());
14521454
builder.setDeleteIntent(PendingIntent.getBroadcast(
14531455
mContext, 0, snoozeIntent, PendingIntent.FLAG_UPDATE_CURRENT));
14541456

@@ -5043,17 +5045,19 @@ private static Intent buildAllowBackgroundDataIntent() {
50435045
return new Intent(ACTION_ALLOW_BACKGROUND);
50445046
}
50455047

5046-
private static Intent buildSnoozeWarningIntent(NetworkTemplate template) {
5048+
private static Intent buildSnoozeWarningIntent(NetworkTemplate template, String targetPackage) {
50475049
final Intent intent = new Intent(ACTION_SNOOZE_WARNING);
50485050
intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
50495051
intent.putExtra(EXTRA_NETWORK_TEMPLATE, template);
5052+
intent.setPackage(targetPackage);
50505053
return intent;
50515054
}
50525055

5053-
private static Intent buildSnoozeRapidIntent(NetworkTemplate template) {
5056+
private static Intent buildSnoozeRapidIntent(NetworkTemplate template, String targetPackage) {
50545057
final Intent intent = new Intent(ACTION_SNOOZE_RAPID);
50555058
intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
50565059
intent.putExtra(EXTRA_NETWORK_TEMPLATE, template);
5060+
intent.setPackage(targetPackage);
50575061
return intent;
50585062
}
50595063

‎services/core/java/com/android/server/notification/NotificationManagerService.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3848,18 +3848,24 @@ public ParceledListSlice<StatusBarNotification> getAppActiveNotifications(String
38483848
}
38493849
}
38503850

3851+
/** Notifications returned here will have allowlistToken stripped from them. */
38513852
private StatusBarNotification sanitizeSbn(String pkg, int userId,
38523853
StatusBarNotification sbn) {
38533854
if (sbn.getUserId() == userId) {
38543855
if (sbn.getPackageName().equals(pkg) || sbn.getOpPkg().equals(pkg)) {
38553856
// We could pass back a cloneLight() but clients might get confused and
38563857
// try to send this thing back to notify() again, which would not work
38573858
// very well.
3859+
Notification notification = sbn.getNotification().clone();
3860+
// Remove background token before returning notification to untrusted app, this
3861+
// ensures the app isn't able to perform background operations that are
3862+
// associated with notification interactions.
3863+
notification.setAllowlistToken(null);
38583864
return new StatusBarNotification(
38593865
sbn.getPackageName(),
38603866
sbn.getOpPkg(),
38613867
sbn.getId(), sbn.getTag(), sbn.getUid(), sbn.getInitialPid(),
3862-
sbn.getNotification().clone(),
3868+
notification,
38633869
sbn.getUser(), sbn.getOverrideGroupKey(), sbn.getPostTime());
38643870
}
38653871
}

0 commit comments

Comments
 (0)