From f11f9f47d3cfb5d1b9e7da1705252e75913410f1 Mon Sep 17 00:00:00 2001
From: Fyodor Kupolov <fkupolov@google.com>
Date: Tue, 18 Nov 2014 15:08:12 -0800
Subject: [PATCH] Added a check if a custom activity can be started

AppRestrictionsFragment starts an activity using an intent provided by the
receiver. A check was added to prevent an app from starting an activity that
it does not own.

Bug: 14441412
Change-Id: Ia6820b1daf3783d605b92976c78cb522b17dc8f2
(cherry picked from commit 07ab95c43e49facb0fc4dd11d68645b4fe8d4c88)
---
 .../users/AppRestrictionsFragment.java        | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/com/android/settings/users/AppRestrictionsFragment.java b/src/com/android/settings/users/AppRestrictionsFragment.java
index f1022b9a2eb..fcaf18f4f4f 100644
--- a/src/com/android/settings/users/AppRestrictionsFragment.java
+++ b/src/com/android/settings/users/AppRestrictionsFragment.java
@@ -24,6 +24,7 @@ import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.content.RestrictionEntry;
+import android.content.pm.ActivityInfo;
 import android.content.pm.ApplicationInfo;
 import android.content.pm.IPackageManager;
 import android.content.pm.PackageInfo;
@@ -924,6 +925,7 @@ public class AppRestrictionsFragment extends SettingsPreferenceFragment implemen
             } else if (restrictionsIntent != null) {
                 preference.setRestrictions(restrictions);
                 if (invokeIfCustom && AppRestrictionsFragment.this.isResumed()) {
+                    assertSafeToStartCustomActivity(restrictionsIntent);
                     int requestCode = generateCustomActivityRequestCode(
                             RestrictionsResultReceiver.this.preference);
                     AppRestrictionsFragment.this.startActivityForResult(
@@ -931,6 +933,25 @@ public class AppRestrictionsFragment extends SettingsPreferenceFragment implemen
                 }
             }
         }
+
+        private void assertSafeToStartCustomActivity(Intent intent) {
+            // Activity can be started if it belongs to the same app
+            if (intent.getPackage() != null && intent.getPackage().equals(packageName)) {
+                return;
+            }
+            // Activity can be started if intent resolves to multiple activities
+            List<ResolveInfo> resolveInfos = AppRestrictionsFragment.this.mPackageManager
+                    .queryIntentActivities(intent, 0 /* no flags */);
+            if (resolveInfos.size() != 1) {
+                return;
+            }
+            // Prevent potential privilege escalation
+            ActivityInfo activityInfo = resolveInfos.get(0).activityInfo;
+            if (!packageName.equals(activityInfo.packageName)) {
+                throw new SecurityException("Application " + packageName
+                        + " is not allowed to start activity " + intent);
+            };
+        }
     }
 
     private void onRestrictionsReceived(AppRestrictionsPreference preference, String packageName,