Merge changes from topic "am-32ac52b1-d1ae-4650-b9ae-368d8cd519cb" into cw-f-dev
* changes:
[automerger] RESTRICT AUTOMERGE: Prevent shortcut info package name spoofing am: 2f7d50058a
RESTRICT AUTOMERGE: Prevent shortcut info package name spoofing
diff --git a/services/core/java/com/android/server/pm/ShortcutService.java b/services/core/java/com/android/server/pm/ShortcutService.java
index 500af0c..afc74ad 100644
--- a/services/core/java/com/android/server/pm/ShortcutService.java
+++ b/services/core/java/com/android/server/pm/ShortcutService.java
@@ -124,6 +124,7 @@
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
+import java.util.Objects;
import java.util.concurrent.atomic.AtomicBoolean;
import java.util.function.Consumer;
import java.util.function.Predicate;
@@ -1523,6 +1524,24 @@
throw new SecurityException("Calling package name mismatch");
}
+ private void verifyShortcutInfoPackage(String callerPackage, ShortcutInfo si) {
+ if (si == null) {
+ return;
+ }
+ if (!Objects.equals(callerPackage, si.getPackage())) {
+ android.util.EventLog.writeEvent(0x534e4554, "109824443", -1, "");
+ throw new SecurityException("Shortcut package name mismatch");
+ }
+ }
+
+ private void verifyShortcutInfoPackages(
+ String callerPackage, List<ShortcutInfo> list) {
+ final int size = list.size();
+ for (int i = 0; i < size; i++) {
+ verifyShortcutInfoPackage(callerPackage, list.get(i));
+ }
+ }
+
// Overridden in unit tests to execute r synchronously.
void injectPostToHandler(Runnable r) {
mHandler.post(r);
@@ -1651,6 +1670,7 @@
verifyCaller(packageName, userId);
final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();
+ verifyShortcutInfoPackages(packageName, newShortcuts);
final int size = newShortcuts.size();
synchronized (mLock) {
@@ -1702,6 +1722,7 @@
verifyCaller(packageName, userId);
final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();
+ verifyShortcutInfoPackages(packageName, newShortcuts);
final int size = newShortcuts.size();
synchronized (mLock) {
@@ -1782,6 +1803,7 @@
verifyCaller(packageName, userId);
final List<ShortcutInfo> newShortcuts = (List<ShortcutInfo>) shortcutInfoList.getList();
+ verifyShortcutInfoPackages(packageName, newShortcuts);
final int size = newShortcuts.size();
synchronized (mLock) {