Skip to content

Commit 0c4e5ba

Browse files
Treehugger Robotandroid-build-merge-worker-robot
Treehugger Robot
authored and
android-build-merge-worker-robot
committed
Merge "CTS test for Android Security b/277593270" into rvc-dev am: 1ddd892 am: 1991310 am: a7ff1b1 am: 2c15374 am: 1fee24a am: 941c847 am: 6af720e
Original change: https://googleplex-android-review.googlesource.com/c/platform/cts/+/24583552 Change-Id: I267ef6f7354fe741c6efa4ac115fa52017a7b4f7 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2 parents f7948c7 + 6af720e commit 0c4e5ba

4 files changed

Lines changed: 298 additions & 0 deletions

File tree

‎hostsidetests/securitybulletin/src/android/security/cts/CVE_2023_21291.java‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/*
2+
* Copyright (C) 2023 The Android Open Source Project
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package android.security.cts;
18+
19+
import static org.junit.Assume.assumeNoException;
20+
21+
import android.platform.test.annotations.AsbSecurityTest;
22+
23+
import com.android.sts.common.SystemUtil;
24+
import com.android.sts.common.UserUtils;
25+
import com.android.sts.common.tradefed.testtype.NonRootSecurityTestCase;
26+
import com.android.tradefed.device.ITestDevice;
27+
import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
28+
29+
import org.junit.Test;
30+
import org.junit.runner.RunWith;
31+
32+
@RunWith(DeviceJUnit4ClassRunner.class)
33+
public class CVE_2023_21291 extends NonRootSecurityTestCase {
34+
35+
@AsbSecurityTest(cveBugId = 277593270)
36+
@Test
37+
public void testPocCVE_2023_21291() {
38+
try {
39+
// Install application
40+
installPackage("CVE-2023-21291.apk", "-g");
41+
42+
// Create a secondary user cve_2023_21291_user and enable global hidden_api_policy to
43+
// access hidden field in DeviceTest
44+
ITestDevice device = getDevice();
45+
try (AutoCloseable closable =
46+
SystemUtil.withSetting(device, "global", "hidden_api_policy", "1");
47+
AutoCloseable asSecondaryUser =
48+
new UserUtils.SecondaryUser(device)
49+
.name("cve_2023_21291_user")
50+
.withUser()) {
51+
52+
// Run DeviceTest
53+
final String testPkg = "android.security.cts.CVE_2023_21291";
54+
runDeviceTests(testPkg, testPkg + ".DeviceTest", "testPocCVE_2023_21291");
55+
}
56+
} catch (Exception e) {
57+
assumeNoException(e);
58+
}
59+
}
60+
}

‎hostsidetests/securitybulletin/test-apps/CVE-2023-21291/Android.bp‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/*
2+
* Copyright (C) 2023 The Android Open Source Project
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at:
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*
16+
*/
17+
18+
package {
19+
default_applicable_licenses: ["Android-Apache-2.0"],
20+
}
21+
22+
android_test_helper_app {
23+
name: "CVE-2023-21291",
24+
defaults: ["cts_support_defaults"],
25+
srcs: [
26+
"src/**/*.java",
27+
],
28+
test_suites: [
29+
"sts",
30+
],
31+
static_libs: [
32+
"androidx.test.core",
33+
"androidx.test.rules",
34+
"compatibility-device-util-axt",
35+
"sts-device-util",
36+
],
37+
}

‎hostsidetests/securitybulletin/test-apps/CVE-2023-21291/AndroidManifest.xml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<!--
3+
Copyright 2023 The Android Open Source Project
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
-->
17+
18+
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
19+
package="android.security.cts.CVE_2023_21291">
20+
<uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
21+
22+
<instrumentation
23+
android:name="androidx.test.runner.AndroidJUnitRunner"
24+
android:targetPackage="android.security.cts.CVE_2023_21291" />
25+
</manifest>

‎hostsidetests/securitybulletin/test-apps/CVE-2023-21291/src/android/security/cts/CVE_2023_21291/DeviceTest.java‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
/*
2+
* Copyright (C) 2023 The Android Open Source Project
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package android.security.cts.CVE_2023_21291;
18+
19+
import static android.Manifest.permission.CREATE_USERS;
20+
import static android.provider.MediaStore.Images.Media.EXTERNAL_CONTENT_URI;
21+
22+
import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
23+
24+
import static com.android.sts.common.SystemUtil.poll;
25+
26+
import static org.junit.Assert.assertFalse;
27+
import static org.junit.Assume.assumeNoException;
28+
import static org.junit.Assume.assumeTrue;
29+
30+
import android.app.Instrumentation;
31+
import android.app.Notification;
32+
import android.app.NotificationChannel;
33+
import android.app.NotificationManager;
34+
import android.app.Person;
35+
import android.content.ContentProvider;
36+
import android.content.Context;
37+
import android.content.pm.UserInfo;
38+
import android.graphics.drawable.Icon;
39+
import android.os.UserManager;
40+
import android.provider.MediaStore;
41+
import android.service.notification.StatusBarNotification;
42+
import android.util.Log;
43+
44+
import androidx.test.runner.AndroidJUnit4;
45+
46+
import com.android.compatibility.common.util.SystemUtil;
47+
48+
import org.junit.Test;
49+
import org.junit.runner.RunWith;
50+
51+
import java.util.List;
52+
53+
@RunWith(AndroidJUnit4.class)
54+
public class DeviceTest {
55+
56+
@Test
57+
public void testPocCVE_2023_21291() {
58+
try {
59+
Instrumentation instrumentation = getInstrumentation();
60+
Context context = instrumentation.getContext();
61+
final UserManager userManager = context.getSystemService(UserManager.class);
62+
63+
// Check if the device supports multiple users or not
64+
assumeTrue(
65+
"This device does not support multiple users",
66+
userManager.supportsMultipleUsers());
67+
68+
// Get the user id of "cve_2023_21291_user"
69+
int testUserId =
70+
SystemUtil.runWithShellPermissionIdentity(
71+
() -> {
72+
List<UserInfo> list = userManager.getUsers();
73+
for (UserInfo info : list) {
74+
if (info.toString().contains("cve_2023_21291_user")) {
75+
return info.getUserHandle().getIdentifier();
76+
}
77+
}
78+
return -1;
79+
},
80+
CREATE_USERS);
81+
assumeTrue("Unable to find the user cve_2023_21291_user", testUserId != -1);
82+
83+
// Insert a placeholder content in the new user and query it to see if it has been
84+
// inserted successfully
85+
final String imagesContentUri = EXTERNAL_CONTENT_URI.toString();
86+
assumeTrue(
87+
"Failed to insert a placeholder content in the test user",
88+
poll(
89+
() -> {
90+
try {
91+
SystemUtil.runShellCommand(
92+
instrumentation,
93+
String.format(
94+
"content insert --user %d --uri %s --bind "
95+
+ "_display_name:s:cve_2023_21291.jpg",
96+
testUserId, imagesContentUri));
97+
return SystemUtil.runShellCommand(
98+
instrumentation,
99+
String.format(
100+
"content query " + "--user %d --uri %s",
101+
testUserId, imagesContentUri))
102+
.contains("Row");
103+
} catch (Exception e) {
104+
Log.i("CVE-2023-21291", "Got an exception: " + e);
105+
}
106+
return false;
107+
}));
108+
109+
// Create notificationManager
110+
NotificationManager notificationManager =
111+
context.getSystemService(NotificationManager.class);
112+
113+
// Create notificationChannel
114+
String channelId = "cve_2023_21291_channel_id";
115+
notificationManager.createNotificationChannel(
116+
new NotificationChannel(
117+
channelId,
118+
"cve_2023_21291_channel_name" /* notification channel name */,
119+
NotificationManager.IMPORTANCE_DEFAULT));
120+
121+
// Post the Notification and check if any security exception is caught
122+
try {
123+
notificationManager.notify(
124+
0 /* notification id */,
125+
new Notification.Builder(context)
126+
.setChannelId(channelId)
127+
.setStyle(
128+
new Notification.MessagingStyle(
129+
new Person.Builder()
130+
.setName("cve_2023_21291_person")
131+
.build())
132+
.setShortcutIcon(
133+
Icon.createWithContentUri(
134+
ContentProvider.maybeAddUserId(
135+
EXTERNAL_CONTENT_URI,
136+
testUserId))))
137+
.setSmallIcon(
138+
Icon.createWithData(
139+
new byte[0] /* data */,
140+
0 /* offset */,
141+
0 /* length */))
142+
.build());
143+
} catch (SecurityException securityException) {
144+
if (securityException
145+
.getLocalizedMessage()
146+
.toLowerCase()
147+
.contains(MediaStore.Images.Media.EXTERNAL_CONTENT_URI.toString())) {
148+
// Ignore exception thrown with fix and exit the test
149+
return;
150+
} else {
151+
throw securityException;
152+
}
153+
}
154+
155+
// Check if notification gets posted or not, fail the test if notification gets posted
156+
assertFalse(
157+
"Device is vulnerable to b/277593270 hence images belonging to another user on"
158+
+ " the same device can be displayed in conversation notifications",
159+
poll(
160+
() -> {
161+
StatusBarNotification[] activeNotifications =
162+
notificationManager.getActiveNotifications();
163+
for (StatusBarNotification notification : activeNotifications) {
164+
if (notification
165+
.getPackageName()
166+
.equals(context.getPackageName())) {
167+
return true;
168+
}
169+
}
170+
return false;
171+
}));
172+
} catch (Exception e) {
173+
assumeNoException(e);
174+
}
175+
}
176+
}

0 commit comments

Comments
 (0)