Skip to content

Commit 99ff1e1

Browse files
Treehugger Robotandroid-build-merge-worker-robot
Treehugger Robot
authored and
android-build-merge-worker-robot
committed
Merge "CTS test for Android Security b/229256049" into tm-dev am: 122a9b4 am: adc36fb
Original change: https://googleplex-android-review.googlesource.com/c/platform/cts/+/23807534 Change-Id: I3c571037b5f6f4feb6ce2351be2e0e7bb9dc7444 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2 parents b9ec5ca + adc36fb commit 99ff1e1

3 files changed

Lines changed: 161 additions & 0 deletions

File tree

‎tests/tests/security/AndroidManifest.xml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,14 @@
264264
<activity android:name="android.security.cts.CVE_2023_20953.PocActivity"
265265
android:exported="true" />
266266

267+
<activity android:name="android.security.cts.CVE_2023_20916.PocActivity"
268+
android:exported="true">
269+
<intent-filter>
270+
<action android:name="android.intent.action.MAIN" />
271+
<category android:name="android.intent.category.LAUNCHER" />
272+
</intent-filter>
273+
</activity>
274+
267275
<activity android:name="android.security.cts.CVE_2021_0642.PocActivity"
268276
android:exported="true">
269277
<intent-filter>

‎tests/tests/security/src/android/security/cts/CVE_2023_20916/CVE_2023_20916.java‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
/*
2+
* Copyright (C) 2022 The Android Open Source Project
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package android.security.cts.CVE_2023_20916;
18+
19+
import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
20+
21+
import static org.junit.Assert.assertFalse;
22+
import static org.junit.Assume.assumeFalse;
23+
import static org.junit.Assume.assumeNoException;
24+
25+
import android.app.PendingIntent;
26+
import android.content.BroadcastReceiver;
27+
import android.content.ComponentName;
28+
import android.content.Context;
29+
import android.content.Intent;
30+
import android.content.IntentFilter;
31+
import android.content.pm.LauncherApps;
32+
import android.content.pm.PackageManager;
33+
import android.os.Bundle;
34+
import android.os.Process;
35+
import android.os.UserHandle;
36+
import android.platform.test.annotations.AsbSecurityTest;
37+
38+
import androidx.test.runner.AndroidJUnit4;
39+
40+
import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
41+
42+
import org.junit.Test;
43+
import org.junit.runner.RunWith;
44+
45+
import java.lang.reflect.Method;
46+
import java.util.concurrent.Semaphore;
47+
import java.util.concurrent.TimeUnit;
48+
49+
@RunWith(AndroidJUnit4.class)
50+
public class CVE_2023_20916 extends StsExtraBusinessLogicTestCase {
51+
private static final long TIMEOUT_MS = 10_000L;
52+
53+
// b/229256049
54+
// Vulnerable library : services.jar, framework.jar
55+
// Vulnerable module : Not applicable
56+
// Is Play managed : No
57+
@AsbSecurityTest(cveBugId = 229256049)
58+
@Test
59+
public void testPocCVE_2023_20916() {
60+
try {
61+
// Ensure that the test app does not have the ACCESS_SHORTCUTS permission
62+
Context context = getApplicationContext();
63+
assumeFalse("The test requires the app to not have the ACCESS_SHORTCUTS permission",
64+
context.checkPermission(android.Manifest.permission.ACCESS_SHORTCUTS,
65+
Process.myPid(), Process.myUid()) == PackageManager.PERMISSION_GRANTED);
66+
67+
// Make a call to the vulnerable function getMainActivityLaunchIntent()
68+
Method method = LauncherApps.class.getMethod("getMainActivityLaunchIntent",
69+
ComponentName.class, Bundle.class, UserHandle.class);
70+
PendingIntent pi =
71+
(PendingIntent) method.invoke(context.getSystemService(LauncherApps.class),
72+
new ComponentName(context, PocActivity.class), null,
73+
UserHandle.getUserHandleForUid(Process.myUid()));
74+
75+
// Register a broadcast receiver to receive broadcast from PocActivity indicating
76+
// presence of vulnerability
77+
final Semaphore broadcastReceived = new Semaphore(0);
78+
final String bcastAction = "CVE_2023_20916_action";
79+
BroadcastReceiver broadcastReceiver = new BroadcastReceiver() {
80+
@Override
81+
public void onReceive(Context context, Intent intent) {
82+
try {
83+
if (intent.getAction().equals(bcastAction)) {
84+
broadcastReceived.release();
85+
}
86+
} catch (Exception ignored) {
87+
// ignore any exceptions
88+
}
89+
}
90+
};
91+
IntentFilter filter = new IntentFilter(bcastAction);
92+
context.registerReceiver(broadcastReceiver, filter);
93+
94+
// Attempt to launch the PocActivity using the pending intent received by calling
95+
// getMainActivityLaunchIntent()
96+
context.startIntentSender(pi.getIntentSender(), null, 0, 0, 0, null);
97+
98+
// On vulnerable device, PocActivity is successfully launched using
99+
// LauncherAppsService#getActivityLaunchIntent and sends a broadcast, if it is received
100+
// successfully, the test fails.
101+
assertFalse("Device is vulnerable to b/229256049 !!",
102+
broadcastReceived.tryAcquire(TIMEOUT_MS, TimeUnit.MILLISECONDS));
103+
} catch (Exception e) {
104+
try {
105+
if (e.getCause() instanceof SecurityException && e.getCause().getMessage()
106+
.contains("Caller can't access shortcut information")) {
107+
// this exception is thrown with fix so ignoring it
108+
return;
109+
}
110+
} catch (Exception ignored) {
111+
// ignore any exceptions
112+
}
113+
assumeNoException(e);
114+
}
115+
}
116+
}

‎tests/tests/security/src/android/security/cts/CVE_2023_20916/PocActivity.java‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/*
2+
* Copyright (C) 2022 The Android Open Source Project
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package android.security.cts.CVE_2023_20916;
18+
19+
import android.app.Activity;
20+
import android.content.Intent;
21+
import android.os.Bundle;
22+
23+
public class PocActivity extends Activity {
24+
25+
@Override
26+
protected void onCreate(Bundle savedInstanceState) {
27+
try {
28+
super.onCreate(savedInstanceState);
29+
30+
// PocActivity has been launched successfully, this indicates presence of vulnerability
31+
// so broadcasting it to DeviceTest.
32+
sendBroadcast(new Intent("CVE_2023_20916_action"));
33+
} catch (Exception ignored) {
34+
// ignore any exceptions
35+
}
36+
}
37+
}

0 commit comments

Comments
 (0)