Skip to content

Commit d8c42b0

Browse files
Fabian Kozynskiandroid-build-merge-worker-robot
Fabian Kozynski
authored and
android-build-merge-worker-robot
committed
Merge "STS for bug 300903792" into udc-dev am: dbde6b6 am: c70425f
Original change: https://googleplex-android-review.googlesource.com/c/platform/cts/+/25045596 Change-Id: If14cd6b0b32f10ef54dda772199148d24d163081 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2 parents 2d24670 + c70425f commit d8c42b0

8 files changed

Lines changed: 315 additions & 0 deletions

File tree

‎tests/tests/security/Android.bp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ android_test {
9292
":CtsPermissionBackupAppCert34",
9393
":CtsPermissionBackupAppCert123",
9494
":CtsPermissionBackupAppCert4History124",
95+
":TileServiceNullBindingTestApp",
9596
],
9697
}
9798

‎tests/tests/security/AndroidTest.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@
6363
<option name="push" value="CtsPermissionBackupAppCert123.apk->/data/local/tmp/cts/security/CtsPermissionBackupAppCert123.apk" />
6464
<option name="push" value="CtsPermissionBackupAppCert34.apk->/data/local/tmp/cts/security/CtsPermissionBackupAppCert34.apk" />
6565
<option name="push" value="CtsPermissionBackupAppCert4History124.apk->/data/local/tmp/cts/security/CtsPermissionBackupAppCert4History124.apk" />
66+
<option name="push" value="TileServiceNullBindingTestApp.apk->/data/local/tmp/cts/security/TileServiceNullBindingTestApp.apk" />
6667
</target_preparer>
6768

6869
<test class="com.android.tradefed.testtype.AndroidJUnitTest" >

‎tests/tests/security/TileServiceNullBindingTestApp/Android.bp‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
//
2+
// Copyright (C) 2020 The Android Open Source Project
3+
//
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
//
8+
// http://www.apache.org/licenses/LICENSE-2.0
9+
//
10+
// Unless required by applicable law or agreed to in writing, software
11+
// distributed under the License is distributed on an "AS IS" BASIS,
12+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
// See the License for the specific language governing permissions and
14+
// limitations under the License.
15+
//
16+
17+
package {
18+
default_applicable_licenses: ["Android-Apache-2.0"],
19+
}
20+
21+
android_test_helper_app {
22+
name: "TileServiceNullBindingTestApp",
23+
srcs: [
24+
"src/**/*.kt",
25+
],
26+
static_libs: [
27+
"kotlin-stdlib",
28+
],
29+
30+
min_sdk_version: "30",
31+
target_sdk_version: "33",
32+
}

‎tests/tests/security/TileServiceNullBindingTestApp/AndroidManifest.xml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
3+
<!--
4+
~ Copyright (C) 2021 The Android Open Source Project
5+
~
6+
~ Licensed under the Apache License, Version 2.0 (the "License");
7+
~ you may not use this file except in compliance with the License.
8+
~ You may obtain a copy of the License at
9+
~
10+
~ http://www.apache.org/licenses/LICENSE-2.0
11+
~
12+
~ Unless required by applicable law or agreed to in writing, software
13+
~ distributed under the License is distributed on an "AS IS" BASIS,
14+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
~ See the License for the specific language governing permissions and
16+
~ limitations under the License.
17+
-->
18+
19+
<manifest
20+
xmlns:android="http://schemas.android.com/apk/res/android"
21+
package="android.security.cts.tileservice">
22+
23+
24+
<application android:label="TileService Null Binding Test App"
25+
android:icon="@android:drawable/ic_info">
26+
<activity android:name=".BackgroundLaunchActivity"
27+
android:exported="false">
28+
</activity>
29+
<activity android:name=".ActivityStarterActivity"
30+
android:exported="true">
31+
</activity>
32+
<service android:name=".NullBindingTileService"
33+
android:label="Tile Service"
34+
android:exported="true"
35+
android:icon="@android:drawable/ic_info"
36+
android:permission="android.permission.BIND_QUICK_SETTINGS_TILE">
37+
<intent-filter>
38+
<action android:name="android.service.quicksettings.action.QS_TILE" />
39+
</intent-filter>
40+
</service>
41+
</application>
42+
</manifest>

‎tests/tests/security/TileServiceNullBindingTestApp/src/android/security/cts/tileservice/ActivityStarterActivity.kt‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/*
2+
* Copyright (C) 2023 The Android Open Source Project
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package android.security.cts.tileservice
18+
19+
import android.app.Activity
20+
import android.content.Intent
21+
import android.os.Bundle
22+
import android.os.Handler
23+
import android.widget.FrameLayout
24+
25+
class ActivityStarterActivity : Activity() {
26+
27+
override fun onCreate(savedInstanceState: Bundle?) {
28+
super.onCreate(savedInstanceState)
29+
setContentView(FrameLayout(this))
30+
}
31+
32+
override fun onResume() {
33+
super.onResume()
34+
Handler().postDelayed({
35+
startActivity(Intent(applicationContext, BackgroundLaunchActivity::class.java))
36+
}, DELAY)
37+
minimizeApp()
38+
}
39+
40+
private fun minimizeApp() {
41+
val startMain = Intent(Intent.ACTION_MAIN)
42+
startMain.addCategory(Intent.CATEGORY_HOME)
43+
startMain.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
44+
startActivity(startMain)
45+
}
46+
47+
companion object {
48+
private const val DELAY = 15000L
49+
}
50+
}

‎tests/tests/security/TileServiceNullBindingTestApp/src/android/security/cts/tileservice/BackgroundLaunchActivity.kt‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/*
2+
* Copyright (C) 2023 The Android Open Source Project
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package android.security.cts.tileservice
18+
19+
import android.app.Activity
20+
import android.content.Intent
21+
import android.os.Bundle
22+
23+
class BackgroundLaunchActivity : Activity() {
24+
override fun onCreate(savedInstanceState: Bundle?) {
25+
super.onCreate(savedInstanceState)
26+
sendBroadcast(Intent(BACKGROUND_ACTIVITY_STARTED))
27+
finish()
28+
}
29+
30+
companion object {
31+
private const val BACKGROUND_ACTIVITY_STARTED =
32+
"android.security.cts.tileservice.BACKGROUND_ACTIVITY_STARTED"
33+
}
34+
}

‎tests/tests/security/TileServiceNullBindingTestApp/src/android/security/cts/tileservice/NullBindingTileService.kt‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/*
2+
* Copyright (C) 2023 The Android Open Source Project
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package android.security.cts.tileservice
18+
19+
import android.content.Intent
20+
import android.os.IBinder
21+
import android.service.quicksettings.TileService
22+
23+
class NullBindingTileService : TileService() {
24+
override fun onBind(intent: Intent?): IBinder? {
25+
return null.also {
26+
sendBroadcast(Intent(ON_NULL_BINDING))
27+
}
28+
}
29+
30+
companion object {
31+
private const val ON_NULL_BINDING = "android.security.cts.tileservice.ON_NULL_BINDING"
32+
}
33+
}

‎tests/tests/security/src/android/security/cts/Bug_300903792.kt‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
/*
2+
* Copyright (C) 2023 The Android Open Source Project
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package android.security.cts
18+
19+
import android.content.ComponentName
20+
import android.content.Intent
21+
import android.platform.test.annotations.AsbSecurityTest
22+
import android.service.quicksettings.TileService
23+
import android.util.Log
24+
import androidx.test.ext.junit.runners.AndroidJUnit4
25+
import androidx.test.platform.app.InstrumentationRegistry.getInstrumentation
26+
import com.android.compatibility.common.util.BlockingBroadcastReceiver
27+
import com.android.compatibility.common.util.SystemUtil
28+
import com.android.sts.common.util.StsExtraBusinessLogicTestCase
29+
import org.junit.After
30+
import org.junit.Assert.fail
31+
import org.junit.Assume.assumeTrue
32+
import org.junit.Before
33+
import org.junit.Test
34+
import org.junit.runner.RunWith
35+
36+
@RunWith(AndroidJUnit4::class)
37+
class Bug_300903792 : StsExtraBusinessLogicTestCase() {
38+
39+
@Before
40+
fun setUp() {
41+
assumeTrue(TileService.isQuickSettingsSupported())
42+
installPackage(TILE_SERVICE_APP_LOCATION)
43+
}
44+
45+
@After
46+
fun tearDown() {
47+
SystemUtil.runShellCommand(REMOVE_TILE_COMMAND)
48+
Log.d("TestRunner", "Uninstalling $TILE_SERVICE_PACKAGE")
49+
uninstallPackage(TILE_SERVICE_PACKAGE)
50+
}
51+
52+
@Test
53+
@AsbSecurityTest(cveBugId = [300903792])
54+
fun testPocBug_300903792() {
55+
val context = getInstrumentation().context
56+
val nullBindingReceiver = BlockingBroadcastReceiver(context, ON_NULL_BINDING)
57+
// First we add the tile, we should receive a broadcast once it has bound.
58+
// We expect that the tile will be bound to notify `onTileAdded` and onNullBinding will
59+
// happen.
60+
try {
61+
nullBindingReceiver.register()
62+
SystemUtil.runShellCommand(ADD_TILE_COMMAND)
63+
nullBindingReceiver.awaitForBroadcast(ONE_MINUTE_IN_MILLIS)
64+
} finally {
65+
nullBindingReceiver.unregisterQuietly()
66+
}
67+
68+
val backgroundActivityStarted =
69+
BlockingBroadcastReceiver(context, BACKGROUND_ACTIVITY_STARTED)
70+
// We start an activity that will schedule another activity to start and then go home
71+
// (putting itself in the background). We expect that the backgroundActivity is not started,
72+
// but if the security issue is not patched, it will.
73+
try {
74+
backgroundActivityStarted.register()
75+
context.startActivity(
76+
Intent()
77+
.setComponent(ACTIVITY_STARTER_COMPONENT)
78+
.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
79+
)
80+
val intent = backgroundActivityStarted.awaitForBroadcast(ONE_MINUTE_IN_MILLIS)
81+
if (intent != null) {
82+
fail("Vulnerable to b/300903792! Activity started from the background")
83+
}
84+
} finally {
85+
backgroundActivityStarted.unregisterQuietly()
86+
}
87+
}
88+
89+
private fun installPackage(apkPath: String) {
90+
val result = SystemUtil.runShellCommand("pm install -r $apkPath")
91+
Log.d("security", "Install result: $result")
92+
}
93+
94+
private fun uninstallPackage(packageName: String) {
95+
SystemUtil.runShellCommand("pm uninstall $packageName")
96+
}
97+
98+
companion object {
99+
private const val TILE_SERVICE_APP_LOCATION =
100+
"/data/local/tmp/cts/security/TileServiceNullBindingTestApp.apk"
101+
private const val TILE_SERVICE_PACKAGE = "android.security.cts.tileservice"
102+
private const val TILE_SERVICE_NAME = ".NullBindingTileService"
103+
private const val ACTIVITY_STARTER_NAME = ".ActivityStarterActivity"
104+
105+
private val TILE_SERVICE_COMPONENT =
106+
ComponentName.createRelative(TILE_SERVICE_PACKAGE, TILE_SERVICE_NAME)
107+
private val ACTIVITY_STARTER_COMPONENT =
108+
ComponentName.createRelative(TILE_SERVICE_PACKAGE, ACTIVITY_STARTER_NAME)
109+
110+
private const val BACKGROUND_ACTIVITY_STARTED =
111+
"android.security.cts.tileservice.BACKGROUND_ACTIVITY_STARTED"
112+
113+
private const val ON_NULL_BINDING = "android.security.cts.tileservice.ON_NULL_BINDING"
114+
115+
private val ADD_TILE_COMMAND =
116+
"cmd statusbar add-tile ${TILE_SERVICE_COMPONENT.flattenToString()}"
117+
private val REMOVE_TILE_COMMAND =
118+
"cmd statusbar remove-tile ${TILE_SERVICE_COMPONENT.flattenToString()}"
119+
120+
private const val ONE_MINUTE_IN_MILLIS = 60 * 1000L
121+
}
122+
}

0 commit comments

Comments
 (0)