PawletOS/app_Settings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent HTML Injection on the Device Admin request screen

Browse Source 
The root issue is that CharSequence is an interface.
String implements that interface, however, Spanned class
too which is a rich text format that can store HTML code.

The solution is enforce to use String type which won't include
any HTML function.

Test: Rebuilt apk and see the string without HTML style.
Bug: 179042963
Change-Id: I53b460b12da918e022d2f2934f114d205dbaadb0
Merged-In: I53b460b12da918e022d2f2934f114d205dbaadb0
This commit is contained in:
Tsung-Mao Fang
2021-04-13 16:26:12 +08:00
parent f43af46d1d
commit 80c3f6d4d8
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/com/android/settings/DeviceAdminAdd.java
View File

@@ -95,7 +95,7 @@ public class DeviceAdminAdd extends Activity {
DevicePolicyManager mDPM; DevicePolicyManager mDPM;
AppOpsManager mAppOps; AppOpsManager mAppOps;
DeviceAdminInfo mDeviceAdmin; DeviceAdminInfo mDeviceAdmin;
CharSequence mAddMsgText; String mAddMsgText;
String mProfileOwnerName; String mProfileOwnerName;
ImageView mAdminIcon; ImageView mAdminIcon;
@@ -278,7 +278,11 @@ public class DeviceAdminAdd extends Activity {
return; return;
} }
mAddMsgText = getIntent().getCharSequenceExtra(DevicePolicyManager.EXTRA_ADD_EXPLANATION); final CharSequence addMsgCharSequence = getIntent().getCharSequenceExtra(
DevicePolicyManager.EXTRA_ADD_EXPLANATION);
if (addMsgCharSequence != null) {
mAddMsgText = addMsgCharSequence.toString();
}
setContentView(R.layout.device_admin_add); setContentView(R.layout.device_admin_add);
@@ -558,7 +562,7 @@ public class DeviceAdminAdd extends Activity {
if (mAddingProfileOwner) { if (mAddingProfileOwner) {
mProfileOwnerWarning.setVisibility(View.VISIBLE); mProfileOwnerWarning.setVisibility(View.VISIBLE);
} }
if (mAddMsgText != null) { if (!TextUtils.isEmpty(mAddMsgText)) {
mAddMsg.setText(mAddMsgText); mAddMsg.setText(mAddMsgText);
mAddMsg.setVisibility(View.VISIBLE); mAddMsg.setVisibility(View.VISIBLE);
} else { } else {