PawletOS/app_Settings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove Intent selector from 2-pane deep link Intent

Browse Source 
To guard against the arbitrary Intent injection through Selector.

Bug: 246300272
Test: make RunSettingsRoboTests ROBOTEST_FILTER=SettingsActivityTest
Change-Id: I8b3b936de490f09f4be960fdafc6e66a1d858ee2
This commit is contained in:
Arc Wang
2022-11-01 18:31:04 +08:00
parent bcd7e55ffa
commit 3b1587d6b2
2 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/com/android/settings/SettingsActivity.java
View File

@@ -397,6 +397,10 @@ public class SettingsActivity extends SettingsBaseActivity
*/ */
public static Intent getTrampolineIntent(Intent intent, String highlightMenuKey) { public static Intent getTrampolineIntent(Intent intent, String highlightMenuKey) {
final Intent detailIntent = new Intent(intent); final Intent detailIntent = new Intent(intent);
// Guard against the arbitrary Intent injection.
if (detailIntent.getSelector() != null) {
detailIntent.setSelector(null);
}
// It's a deep link intent, SettingsHomepageActivity will set SplitPairRule and start it. // It's a deep link intent, SettingsHomepageActivity will set SplitPairRule and start it.
final Intent trampolineIntent = new Intent(ACTION_SETTINGS_EMBED_DEEP_LINK_ACTIVITY) final Intent trampolineIntent = new Intent(ACTION_SETTINGS_EMBED_DEEP_LINK_ACTIVITY)
.setPackage(Utils.SETTINGS_PACKAGE_NAME) .setPackage(Utils.SETTINGS_PACKAGE_NAME)

27
tests/robotests/src/com/android/settings/SettingsActivityTest.java
View File

@@ -16,6 +16,8 @@
package com.android.settings; package com.android.settings;
import static android.provider.Settings.EXTRA_SETTINGS_EMBEDDED_DEEP_LINK_INTENT_URI;
import static com.android.settings.SettingsActivity.EXTRA_SHOW_FRAGMENT; import static com.android.settings.SettingsActivity.EXTRA_SHOW_FRAGMENT;
import static com.google.common.truth.Truth.assertThat; import static com.google.common.truth.Truth.assertThat;
@@ -30,6 +32,7 @@ import static org.mockito.Mockito.when;
import android.app.ActivityManager; import android.app.ActivityManager;
import android.content.Context; import android.content.Context;
import android.content.Intent; import android.content.Intent;
import android.net.Uri;
import androidx.fragment.app.Fragment; import androidx.fragment.app.Fragment;
import androidx.fragment.app.FragmentManager; import androidx.fragment.app.FragmentManager;
@@ -49,6 +52,7 @@ import org.robolectric.RobolectricTestRunner;
import org.robolectric.RuntimeEnvironment; import org.robolectric.RuntimeEnvironment;
import org.robolectric.annotation.Config; import org.robolectric.annotation.Config;
import java.net.URISyntaxException;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.List; import java.util.List;
@@ -114,6 +118,29 @@ public class SettingsActivityTest {
assertThat(((ListenerFragment) fragments.get(1)).mOnActivityResultCalled).isTrue(); assertThat(((ListenerFragment) fragments.get(1)).mOnActivityResultCalled).isTrue();
} }
@Test
public void getTrampolineIntent_intentSelector_shouldNotChangeIntentAction() {
Intent targetIntent = new Intent().setClassName("android",
"com.android.internal.app.PlatLogoActivity");
Intent intent = new Intent(android.provider.Settings.ACTION_DISPLAY_SETTINGS);
intent.setComponent(intent.resolveActivity(mContext.getPackageManager()));
intent.setSelector(new Intent().setData(
Uri.fromParts(targetIntent.toUri(Intent.URI_INTENT_SCHEME), /* ssp= */ "",
/* fragment= */ null)));
Intent resultIntent = SettingsActivity.getTrampolineIntent(intent, "menu_key");
String intentUriString =
resultIntent.getStringExtra(EXTRA_SETTINGS_EMBEDDED_DEEP_LINK_INTENT_URI);
Intent parsedIntent = null;
try {
parsedIntent = Intent.parseUri(intentUriString, Intent.URI_INTENT_SCHEME);
} catch (URISyntaxException e) {
// Do nothng.
}
assertThat(parsedIntent.getAction()).isEqualTo(intent.getAction());
}
public static class ListenerFragment extends Fragment implements OnActivityResultListener { public static class ListenerFragment extends Fragment implements OnActivityResultListener {
private boolean mOnActivityResultCalled; private boolean mOnActivityResultCalled;