PawletOS/app_Settings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix unable to send file via OPP

Browse Source 
Bluetooth app will indicate BluetoothOppReceiver to receive
device picker intent. But for fix the security issue we
removed the setClassName() method in ag/14111132 to avoid attack.
It causes BluetoothOppReceiver cannot receive the intent.

This CL will compare to calling package name with launch package name.
If they are not equal, the setClassName() will not invoke.

Bug: 186490534
Bug: 179386960
Bug: 179386068

Test: make RunSettingsRoboTests -j56
Change-Id: Ia51528f2a44ab73edbc86899ca0846d3262fe1f0
This commit is contained in:
Hugh Chen
2021-04-29 13:53:50 +08:00
parent 9246f6f8b0
commit bb5be240c0
2 changed files with 47 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
tests/robotests/src/com/android/settings/bluetooth/DevicePickerFragmentTest.java
View File

@@ -16,8 +16,11 @@
package com.android.settings.bluetooth;
import static com.google.common.truth.Truth.assertThat;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
@@ -66,16 +69,37 @@ public class DevicePickerFragmentTest {
}
@Test
public void sendBroadcastWithPermission() {
public void callingPackageIsEqualToLaunchPackage_sendBroadcastToLaunchPackage() {
final CachedBluetoothDevice cachedDevice = mock(CachedBluetoothDevice.class);
final BluetoothDevice bluetoothDevice = mock(BluetoothDevice.class);
final ArgumentCaptor<Intent> intentCaptor = ArgumentCaptor.forClass(Intent.class);
when(cachedDevice.getDevice()).thenReturn(bluetoothDevice);
mFragment.mSelectedDevice = bluetoothDevice;
mFragment.mLaunchPackage = "com.android.settings";
mFragment.mLaunchClass = "com.android.settings.bluetooth.BluetoothPermissionActivity";
mFragment.mCallingAppPackageName = "com.android.settings";
mFragment.onDeviceBondStateChanged(cachedDevice, BluetoothDevice.BOND_BONDED);
verify(mContext).sendBroadcast(intentCaptor.capture(),
eq("android.permission.BLUETOOTH_ADMIN"));
assertThat(intentCaptor.getValue().getComponent().getPackageName())
.isEqualTo(mFragment.mLaunchPackage);
}
@Test
public void callingPackageIsNotEqualToLaunchPackage_broadcastNotSend() {
final CachedBluetoothDevice cachedDevice = mock(CachedBluetoothDevice.class);
final BluetoothDevice bluetoothDevice = mock(BluetoothDevice.class);
final ArgumentCaptor<Intent> intentCaptor = ArgumentCaptor.forClass(Intent.class);
when(cachedDevice.getDevice()).thenReturn(bluetoothDevice);
mFragment.mSelectedDevice = bluetoothDevice;
mFragment.mLaunchPackage = "com.fake.settings";
mFragment.mLaunchClass = "com.android.settings.bluetooth.BluetoothPermissionActivity";
mFragment.mCallingAppPackageName = "com.android.settings";
mFragment.onDeviceBondStateChanged(cachedDevice, BluetoothDevice.BOND_BONDED);
verify(mContext, never()).sendBroadcast(intentCaptor.capture());
}
}