Remove Intent selector from 2-pane deep link Intent

To guard against the arbitrary Intent injection through Selector.

Bug: 246300272
Test: make RunSettingsRoboTests ROBOTEST_FILTER=SettingsActivityTest
Change-Id: I76fbf3ff7a6611ebb3d07f73845a64efe1771769
Merged-In: I8b3b936de490f09f4be960fdafc6e66a1d858ee2
(cherry picked from commit dd7d2d766a)
Merged-In: I76fbf3ff7a6611ebb3d07f73845a64efe1771769
This commit is contained in:
Arc Wang
2022-11-02 09:37:32 +08:00
committed by Android Build Coastguard Worker
parent 6dfbfc6c55
commit 0d461c5bed
2 changed files with 31 additions and 0 deletions

View File

@@ -397,6 +397,10 @@ public class SettingsActivity extends SettingsBaseActivity
*/
public static Intent getTrampolineIntent(Intent intent, String highlightMenuKey) {
final Intent detailIntent = new Intent(intent);
// Guard against the arbitrary Intent injection.
if (detailIntent.getSelector() != null) {
detailIntent.setSelector(null);
}
// It's a deep link intent, SettingsHomepageActivity will set SplitPairRule and start it.
final Intent trampolineIntent = new Intent(ACTION_SETTINGS_EMBED_DEEP_LINK_ACTIVITY)
.setPackage(Utils.SETTINGS_PACKAGE_NAME)