Remove Intent selector from 2-pane deep link Intent

To guard against the arbitrary Intent injection through Selector.

Bug: 246300272
Test: make RunSettingsRoboTests ROBOTEST_FILTER=SettingsActivityTest
Change-Id: I8b3b936de490f09f4be960fdafc6e66a1d858ee2
This commit is contained in:
Arc Wang
2022-11-01 18:31:04 +08:00
parent bcd7e55ffa
commit 3b1587d6b2
2 changed files with 31 additions and 0 deletions

View File

@@ -397,6 +397,10 @@ public class SettingsActivity extends SettingsBaseActivity
*/
public static Intent getTrampolineIntent(Intent intent, String highlightMenuKey) {
final Intent detailIntent = new Intent(intent);
// Guard against the arbitrary Intent injection.
if (detailIntent.getSelector() != null) {
detailIntent.setSelector(null);
}
// It's a deep link intent, SettingsHomepageActivity will set SplitPairRule and start it.
final Intent trampolineIntent = new Intent(ACTION_SETTINGS_EMBED_DEEP_LINK_ACTIVITY)
.setPackage(Utils.SETTINGS_PACKAGE_NAME)