PawletOS/app_Settings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RESTRICT AUTOMERGE Fix unable to send file via OPP

Browse Source 
Bluetooth app will indicate BluetoothOppReceiver to receive
device picker intent. But for fix the security issue we
removed the setClassName() method in ag/14111132 to avoid attack.
It causes BluetoothOppReceiver cannot receive the intent.

This CL will compare to calling package name with launch package name.
If they are not equal, the setClassName() will not invoke.

Bug: 186490534
Bug: 179386960
Bug: 179386068

Test: make RunSettingsRoboTests -j56
Change-Id: Ia51528f2a44ab73edbc86899ca0846d3262fe1f0
(cherry picked from commit bb5be240c0)
This commit is contained in:
Hugh Chen
2021-03-12 10:40:20 +08:00
parent 43d093ebe8
commit 51755e9a33
2 changed files with 47 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
tests/robotests/src/com/android/settings/bluetooth/DevicePickerFragmentTest.java
View File

@@ -16,8 +16,11 @@
package com.android.settings.bluetooth;
import static com.google.common.truth.Truth.assertThat;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
@@ -66,16 +69,37 @@ public class DevicePickerFragmentTest {
}
@Test
public void sendBroadcastWithPermission() {
public void callingPackageIsEqualToLaunchPackage_sendBroadcastToLaunchPackage() {
final CachedBluetoothDevice cachedDevice = mock(CachedBluetoothDevice.class);
final BluetoothDevice bluetoothDevice = mock(BluetoothDevice.class);
final ArgumentCaptor<Intent> intentCaptor = ArgumentCaptor.forClass(Intent.class);
when(cachedDevice.getDevice()).thenReturn(bluetoothDevice);
mFragment.mSelectedDevice = bluetoothDevice;
mFragment.mLaunchPackage = "com.android.settings";
mFragment.mLaunchClass = "com.android.settings.bluetooth.BluetoothPermissionActivity";
mFragment.mCallingAppPackageName = "com.android.settings";
mFragment.onDeviceBondStateChanged(cachedDevice, BluetoothDevice.BOND_BONDED);
verify(mContext).sendBroadcast(intentCaptor.capture(),
eq("android.permission.BLUETOOTH_ADMIN"));
assertThat(intentCaptor.getValue().getComponent().getPackageName())
.isEqualTo(mFragment.mLaunchPackage);
}
@Test
public void callingPackageIsNotEqualToLaunchPackage_broadcastNotSend() {
final CachedBluetoothDevice cachedDevice = mock(CachedBluetoothDevice.class);
final BluetoothDevice bluetoothDevice = mock(BluetoothDevice.class);
final ArgumentCaptor<Intent> intentCaptor = ArgumentCaptor.forClass(Intent.class);
when(cachedDevice.getDevice()).thenReturn(bluetoothDevice);
mFragment.mSelectedDevice = bluetoothDevice;
mFragment.mLaunchPackage = "com.fake.settings";
mFragment.mLaunchClass = "com.android.settings.bluetooth.BluetoothPermissionActivity";
mFragment.mCallingAppPackageName = "com.android.settings";
mFragment.onDeviceBondStateChanged(cachedDevice, BluetoothDevice.BOND_BONDED);
verify(mContext, never()).sendBroadcast(intentCaptor.capture());
}
}