From 8adedc62496cf8cf6ecfc6ccf23b0b248081d7d4 Mon Sep 17 00:00:00 2001 From: Hugh Chen Date: Fri, 12 Mar 2021 10:40:20 +0800 Subject: [PATCH] Fix bluetooth settings will broadcast to anywhere when some cases BluetoothPermissionActivity and DevicePickerFragment will send broadcast to return the result to calling apps. As this broadcast intent is from Settings with uid 1000, it will be sent to any protected BroadcastReceivers in the device. It can make an attacker send broadcast to protected BroadcastReceivers like factory reset intent (android/com.android.server.MasterClearReceiver) via BluetoothPermissionActivity or DevicePickerFragment. This CL will not allow to set package name and class name to avoid the attacker. Bug: 179386960 Bug: 179386068 Test: make -j42 RunSettingsRoboTests and use test apk to manually test to verify factory reset not started and no system UI notification. Change-Id: Id27a78091ab578077853b8fbb97a4422cff0a158 --- .../BluetoothPermissionActivity.java | 19 +++--- .../bluetooth/BluetoothPermissionRequest.java | 21 ++----- .../bluetooth/DevicePickerFragment.java | 13 ++--- .../BluetoothPermissionActivityTest.java | 58 +++++++++++++++++++ .../bluetooth/DevicePickerFragmentTest.java | 31 +++++++++- 5 files changed, 107 insertions(+), 35 deletions(-) create mode 100644 tests/robotests/src/com/android/settings/bluetooth/BluetoothPermissionActivityTest.java diff --git a/src/com/android/settings/bluetooth/BluetoothPermissionActivity.java b/src/com/android/settings/bluetooth/BluetoothPermissionActivity.java index e40e30dd0a0..0cca4a4ec51 100644 --- a/src/com/android/settings/bluetooth/BluetoothPermissionActivity.java +++ b/src/com/android/settings/bluetooth/BluetoothPermissionActivity.java @@ -16,6 +16,8 @@ package com.android.settings.bluetooth; +import static android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS; + import android.bluetooth.BluetoothDevice; import android.content.BroadcastReceiver; import android.content.Context; @@ -30,12 +32,11 @@ import android.widget.TextView; import androidx.preference.Preference; +import com.android.internal.annotations.VisibleForTesting; import com.android.internal.app.AlertActivity; import com.android.internal.app.AlertController; import com.android.settings.R; -import static android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS; - /** * BluetoothPermissionActivity shows a dialog for accepting incoming * profile connection request from untrusted devices. @@ -51,8 +52,6 @@ public class BluetoothPermissionActivity extends AlertActivity implements private TextView messageView; private Button mOkButton; private BluetoothDevice mDevice; - private String mReturnPackage = null; - private String mReturnClass = null; private int mRequestType = 0; private BroadcastReceiver mReceiver = new BroadcastReceiver() { @@ -89,8 +88,6 @@ public class BluetoothPermissionActivity extends AlertActivity implements } mDevice = i.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE); - mReturnPackage = i.getStringExtra(BluetoothDevice.EXTRA_PACKAGE_NAME); - mReturnClass = i.getStringExtra(BluetoothDevice.EXTRA_CLASS_NAME); mRequestType = i.getIntExtra(BluetoothDevice.EXTRA_ACCESS_REQUEST_TYPE, BluetoothDevice.REQUEST_TYPE_PHONEBOOK_ACCESS); @@ -202,14 +199,14 @@ public class BluetoothPermissionActivity extends AlertActivity implements sendReplyIntentToReceiver(false, true); } - private void sendReplyIntentToReceiver(final boolean allowed, final boolean always) { + @VisibleForTesting + void sendReplyIntentToReceiver(final boolean allowed, final boolean always) { Intent intent = new Intent(BluetoothDevice.ACTION_CONNECTION_ACCESS_REPLY); - if (mReturnPackage != null && mReturnClass != null) { - intent.setClassName(mReturnPackage, mReturnClass); + if (DEBUG) { + Log.i(TAG, "sendReplyIntentToReceiver() Request type: " + mRequestType + + " mReturnPackage"); } - if (DEBUG) Log.i(TAG, "sendReplyIntentToReceiver() Request type: " + mRequestType + - " mReturnPackage" + mReturnPackage + " mReturnClass" + mReturnClass); intent.putExtra(BluetoothDevice.EXTRA_CONNECTION_ACCESS_RESULT, allowed ? BluetoothDevice.CONNECTION_ACCESS_YES diff --git a/src/com/android/settings/bluetooth/BluetoothPermissionRequest.java b/src/com/android/settings/bluetooth/BluetoothPermissionRequest.java index 7fac4991c7e..66665f06761 100644 --- a/src/com/android/settings/bluetooth/BluetoothPermissionRequest.java +++ b/src/com/android/settings/bluetooth/BluetoothPermissionRequest.java @@ -56,8 +56,6 @@ public final class BluetoothPermissionRequest extends BroadcastReceiver { Context mContext; int mRequestType; BluetoothDevice mDevice; - String mReturnPackage = null; - String mReturnClass = null; @Override public void onReceive(Context context, Intent intent) { @@ -77,11 +75,10 @@ public final class BluetoothPermissionRequest extends BroadcastReceiver { mDevice = intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE); mRequestType = intent.getIntExtra(BluetoothDevice.EXTRA_ACCESS_REQUEST_TYPE, BluetoothDevice.REQUEST_TYPE_PROFILE_CONNECTION); - mReturnPackage = intent.getStringExtra(BluetoothDevice.EXTRA_PACKAGE_NAME); - mReturnClass = intent.getStringExtra(BluetoothDevice.EXTRA_CLASS_NAME); - if (DEBUG) Log.d(TAG, "onReceive request type: " + mRequestType + " return " - + mReturnPackage + "," + mReturnClass); + if (DEBUG) { + Log.d(TAG, "onReceive request type: " + mRequestType); + } // Even if the user has already made the choice, Bluetooth still may not know that if // the user preference data have not been migrated from Settings app's shared @@ -110,8 +107,6 @@ public final class BluetoothPermissionRequest extends BroadcastReceiver { connectionAccessIntent.putExtra(BluetoothDevice.EXTRA_ACCESS_REQUEST_TYPE, mRequestType); connectionAccessIntent.putExtra(BluetoothDevice.EXTRA_DEVICE, mDevice); - connectionAccessIntent.putExtra(BluetoothDevice.EXTRA_PACKAGE_NAME, mReturnPackage); - connectionAccessIntent.putExtra(BluetoothDevice.EXTRA_CLASS_NAME, mReturnClass); String deviceAddress = mDevice != null ? mDevice.getAddress() : null; String deviceName = mDevice != null ? mDevice.getName() : null; @@ -231,7 +226,7 @@ public final class BluetoothPermissionRequest extends BroadcastReceiver { LocalBluetoothManager bluetoothManager = Utils.getLocalBtManager(mContext); CachedBluetoothDeviceManager cachedDeviceManager = - bluetoothManager.getCachedDeviceManager(); + bluetoothManager.getCachedDeviceManager(); CachedBluetoothDevice cachedDevice = cachedDeviceManager.findDevice(mDevice); if (cachedDevice == null) { cachedDevice = cachedDeviceManager.addDevice(mDevice); @@ -289,13 +284,9 @@ public final class BluetoothPermissionRequest extends BroadcastReceiver { private void sendReplyIntentToReceiver(final boolean allowed) { Intent intent = new Intent(BluetoothDevice.ACTION_CONNECTION_ACCESS_REPLY); - if (mReturnPackage != null && mReturnClass != null) { - intent.setClassName(mReturnPackage, mReturnClass); - } - intent.putExtra(BluetoothDevice.EXTRA_CONNECTION_ACCESS_RESULT, - allowed ? BluetoothDevice.CONNECTION_ACCESS_YES - : BluetoothDevice.CONNECTION_ACCESS_NO); + allowed ? BluetoothDevice.CONNECTION_ACCESS_YES + : BluetoothDevice.CONNECTION_ACCESS_NO); intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mDevice); intent.putExtra(BluetoothDevice.EXTRA_ACCESS_REQUEST_TYPE, mRequestType); mContext.sendBroadcast(intent, android.Manifest.permission.BLUETOOTH_ADMIN); diff --git a/src/com/android/settings/bluetooth/DevicePickerFragment.java b/src/com/android/settings/bluetooth/DevicePickerFragment.java index ab8eea5db68..f60183b1c4f 100644 --- a/src/com/android/settings/bluetooth/DevicePickerFragment.java +++ b/src/com/android/settings/bluetooth/DevicePickerFragment.java @@ -48,10 +48,10 @@ public final class DevicePickerFragment extends DeviceListPreferenceFragment { @VisibleForTesting BluetoothProgressCategory mAvailableDevicesCategory; + @VisibleForTesting + Context mContext; private boolean mNeedAuth; - private String mLaunchPackage; - private String mLaunchClass; private boolean mScanAllowed; public DevicePickerFragment() { @@ -64,8 +64,6 @@ public final class DevicePickerFragment extends DeviceListPreferenceFragment { mNeedAuth = intent.getBooleanExtra(BluetoothDevicePicker.EXTRA_NEED_AUTH, false); setFilter(intent.getIntExtra(BluetoothDevicePicker.EXTRA_FILTER_TYPE, BluetoothDevicePicker.FILTER_TYPE_ALL)); - mLaunchPackage = intent.getStringExtra(BluetoothDevicePicker.EXTRA_LAUNCH_PACKAGE); - mLaunchClass = intent.getStringExtra(BluetoothDevicePicker.EXTRA_LAUNCH_CLASS); mAvailableDevicesCategory = (BluetoothProgressCategory) findPreference(KEY_BT_DEVICE_LIST); } @@ -85,6 +83,7 @@ public final class DevicePickerFragment extends DeviceListPreferenceFragment { getActivity().setTitle(getString(R.string.device_picker)); UserManager um = (UserManager) getSystemService(Context.USER_SERVICE); mScanAllowed = !um.hasUserRestriction(DISALLOW_CONFIG_BLUETOOTH); + mContext = getContext(); setHasOptionsMenu(true); } @@ -190,9 +189,7 @@ public final class DevicePickerFragment extends DeviceListPreferenceFragment { private void sendDevicePickedIntent(BluetoothDevice device) { Intent intent = new Intent(BluetoothDevicePicker.ACTION_DEVICE_SELECTED); intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device); - if (mLaunchPackage != null && mLaunchClass != null) { - intent.setClassName(mLaunchPackage, mLaunchClass); - } - getActivity().sendBroadcast(intent, Manifest.permission.BLUETOOTH_ADMIN); + + mContext.sendBroadcast(intent, Manifest.permission.BLUETOOTH_ADMIN); } } diff --git a/tests/robotests/src/com/android/settings/bluetooth/BluetoothPermissionActivityTest.java b/tests/robotests/src/com/android/settings/bluetooth/BluetoothPermissionActivityTest.java new file mode 100644 index 00000000000..35b8f1f00a1 --- /dev/null +++ b/tests/robotests/src/com/android/settings/bluetooth/BluetoothPermissionActivityTest.java @@ -0,0 +1,58 @@ +/* + * Copyright (C) 2021 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.android.settings.bluetooth; + +import static org.mockito.ArgumentMatchers.eq; +import static org.mockito.Mockito.spy; +import static org.mockito.Mockito.verify; + +import android.content.Context; +import android.content.Intent; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.ArgumentCaptor; +import org.mockito.MockitoAnnotations; +import org.robolectric.RobolectricTestRunner; +import org.robolectric.RuntimeEnvironment; +import org.robolectric.util.ReflectionHelpers; + +@RunWith(RobolectricTestRunner.class) +public class BluetoothPermissionActivityTest { + + private BluetoothPermissionActivity mActivity; + private Context mContext; + + @Before + public void setUp() { + MockitoAnnotations.initMocks(this); + mContext = spy(RuntimeEnvironment.application); + mActivity = new BluetoothPermissionActivity(); + } + + @Test + public void sendBroadcastWithPermission() { + final ArgumentCaptor intentCaptor = ArgumentCaptor.forClass(Intent.class); + ReflectionHelpers.setField(mActivity, "mBase", mContext); + + mActivity.sendReplyIntentToReceiver(true, true); + + verify(mContext).sendBroadcast(intentCaptor.capture(), + eq("android.permission.BLUETOOTH_ADMIN")); + } +} diff --git a/tests/robotests/src/com/android/settings/bluetooth/DevicePickerFragmentTest.java b/tests/robotests/src/com/android/settings/bluetooth/DevicePickerFragmentTest.java index feaf6831420..d9e054d86a6 100644 --- a/tests/robotests/src/com/android/settings/bluetooth/DevicePickerFragmentTest.java +++ b/tests/robotests/src/com/android/settings/bluetooth/DevicePickerFragmentTest.java @@ -16,28 +16,43 @@ package com.android.settings.bluetooth; +import static org.mockito.ArgumentMatchers.eq; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.spy; import static org.mockito.Mockito.verify; +import static org.mockito.Mockito.when; + +import android.bluetooth.BluetoothDevice; +import android.content.Context; +import android.content.Intent; + +import com.android.settingslib.bluetooth.CachedBluetoothDevice; import org.junit.Before; import org.junit.Test; import org.junit.runner.RunWith; +import org.mockito.ArgumentCaptor; import org.mockito.Mock; import org.mockito.MockitoAnnotations; import org.robolectric.RobolectricTestRunner; +import org.robolectric.RuntimeEnvironment; @RunWith(RobolectricTestRunner.class) public class DevicePickerFragmentTest { @Mock private BluetoothProgressCategory mAvailableDevicesCategory; + private DevicePickerFragment mFragment; + private Context mContext; @Before public void setUp() { MockitoAnnotations.initMocks(this); mFragment = new DevicePickerFragment(); - + mContext = spy(RuntimeEnvironment.application); + mFragment.mContext = mContext; mFragment.mAvailableDevicesCategory = mAvailableDevicesCategory; } @@ -49,4 +64,18 @@ public class DevicePickerFragmentTest { verify(mAvailableDevicesCategory).setProgress(true); } + + @Test + public void sendBroadcastWithPermission() { + final CachedBluetoothDevice cachedDevice = mock(CachedBluetoothDevice.class); + final BluetoothDevice bluetoothDevice = mock(BluetoothDevice.class); + final ArgumentCaptor intentCaptor = ArgumentCaptor.forClass(Intent.class); + when(cachedDevice.getDevice()).thenReturn(bluetoothDevice); + mFragment.mSelectedDevice = bluetoothDevice; + + mFragment.onDeviceBondStateChanged(cachedDevice, BluetoothDevice.BOND_BONDED); + + verify(mContext).sendBroadcast(intentCaptor.capture(), + eq("android.permission.BLUETOOTH_ADMIN")); + } }