PawletOS/app_Settings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Block the content scheme intent in AccountTypePreferenceLoader

Browse Source 
Bug: 366401629
Flag: EXEMPT security fix
Test: atest AccountTypePreferenceLoaderTest, manual
Change-Id: Ica87087341cc983df04190919e33dc369fa18619
This commit is contained in:
Jason Chiu
2024-11-07 15:33:53 +08:00
parent c0a4fec1e6
commit 841fb3846b
2 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/com/android/settings/accounts/AccountTypePreferenceLoader.java
View File

@@ -20,6 +20,7 @@ package com.android.settings.accounts;
import android.accounts.Account; import android.accounts.Account;
import android.accounts.AuthenticatorDescription; import android.accounts.AuthenticatorDescription;
import android.content.ClipData; import android.content.ClipData;
import android.content.ContentResolver;
import android.content.Context; import android.content.Context;
import android.content.Intent; import android.content.Intent;
import android.content.pm.ActivityInfo; import android.content.pm.ActivityInfo;
@@ -242,13 +243,19 @@ public class AccountTypePreferenceLoader {
} }
/** /**
* Determines if the supplied Intent is safe. A safe intent is one that is * Determines if the supplied Intent is safe. A safe intent is one that
* will launch a exported=true activity or owned by the same uid as the * will launch an exported=true activity or owned by the same uid as the
* authenticator supplying the intent. * authenticator supplying the intent.
*/ */
private boolean isSafeIntent(PackageManager pm, Intent intent, String acccountType) { @VisibleForTesting
boolean isSafeIntent(PackageManager pm, Intent intent, String accountType) {
if (TextUtils.equals(intent.getScheme(), ContentResolver.SCHEME_CONTENT)) {
Log.e(TAG, "Intent with a content scheme is unsafe.");
return false;
}
AuthenticatorDescription authDesc = AuthenticatorDescription authDesc =
mAuthenticatorHelper.getAccountTypeDescription(acccountType); mAuthenticatorHelper.getAccountTypeDescription(accountType);
ResolveInfo resolveInfo = pm.resolveActivityAsUser(intent, 0, mUserHandle.getIdentifier()); ResolveInfo resolveInfo = pm.resolveActivityAsUser(intent, 0, mUserHandle.getIdentifier());
if (resolveInfo == null) { if (resolveInfo == null) {
return false; return false;

12
tests/robotests/src/com/android/settings/accounts/AccountTypePreferenceLoaderTest.java
View File

@@ -30,8 +30,11 @@ import static org.mockito.Mockito.when;
import android.accounts.Account; import android.accounts.Account;
import android.accounts.AccountManager; import android.accounts.AccountManager;
import android.accounts.AuthenticatorDescription; import android.accounts.AuthenticatorDescription;
import android.content.ClipData;
import android.content.Context; import android.content.Context;
import android.content.Intent;
import android.content.pm.PackageManager; import android.content.pm.PackageManager;
import android.net.Uri;
import android.os.UserHandle; import android.os.UserHandle;
import androidx.collection.ArraySet; import androidx.collection.ArraySet;
@@ -250,4 +253,13 @@ public class AccountTypePreferenceLoaderTest {
mPrefLoader.filterBlockedFragments(parent, Set.of("nomatch", "other")); mPrefLoader.filterBlockedFragments(parent, Set.of("nomatch", "other"));
verify(pref).setOnPreferenceClickListener(any()); verify(pref).setOnPreferenceClickListener(any());
} }
@Test
public void isSafeIntent_hasContextScheme_returnFalse() {
Intent intent = new Intent();
intent.setClipData(ClipData.newRawUri(null,
Uri.parse("content://com.android.settings.files/my_cache/NOTICE.html")));
assertThat(mPrefLoader.isSafeIntent(mPackageManager, intent, mAccount.type)).isFalse();
}
} }