Lock down IInputMethodManger.{add,remove}Client()
User mode processes are mistakenly allowed to call
IInputMethodManger.{add,remove}Client(), which may allow malicious
apps to register fake IInputMethodClient binder endpoints to
InputMethodManagerService (IMMS).
Luckily IMMS also checks whether the client process has a focused
window or not by calling IWindowManager.inputMethodClientHasFocus()
before doing some critical operations such as establishing a new
InputConnection between the client app and the current IME.
With this CL, IInputMethodManger.{add,remove}Client() start correctly
checking the caller process ID so that only the system process can
use those internal callbacks.
Bug: 112670859
Test: atest CtsInputMethodTestCases CtsInputMethodServiceHostTestCases
Change-Id: Ib9b588d11bd4017e431e3d494863987dd67384fc
1 file changed