PawletOS/app_Settings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Block the content scheme intent in AccountTypePreferenceLoader

Browse Source 
Also prevent intent defined in AccountPreference from leaking access

Bug: 366401629
Flag: EXEMPT security fix
Test: atest AccountTypePreferenceLoaderTest, manual
Change-Id: Ica87087341cc983df04190919e33dc369fa18619
Merged-In: Ica87087341cc983df04190919e33dc369fa18619
(cherry picked from commit 841fb3846b)
This commit is contained in:
Jason Chiu
2024-11-07 15:33:53 +08:00
parent 4296cc1977
commit d782f9c4bc
2 changed files with 32 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
tests/robotests/src/com/android/settings/accounts/AccountTypePreferenceLoaderTest.java
View File

@@ -16,6 +16,8 @@
package com.android.settings.accounts;
import static com.google.common.truth.Truth.assertThat;
import static org.mockito.Answers.RETURNS_DEEP_STUBS;
import static org.mockito.ArgumentMatchers.anyInt;
import static org.mockito.Mockito.mock;
@@ -26,8 +28,11 @@ import static org.mockito.Mockito.when;
import android.accounts.Account;
import android.accounts.AccountManager;
import android.accounts.AuthenticatorDescription;
import android.content.ClipData;
import android.content.Context;
import android.content.Intent;
import android.content.pm.PackageManager;
import android.net.Uri;
import android.os.UserHandle;
import androidx.preference.Preference;
@@ -129,4 +134,13 @@ public class AccountTypePreferenceLoaderTest {
verify(mPrefLoader).updatePreferenceIntents(prefGroup4, acctType, mAccount);
verify(mPrefLoader).updatePreferenceIntents(prefGroup41, acctType, mAccount);
}
@Test
public void isSafeIntent_hasContextScheme_returnFalse() {
Intent intent = new Intent();
intent.setClipData(ClipData.newRawUri(null,
Uri.parse("content://com.android.settings.files/my_cache/NOTICE.html")));
assertThat(mPrefLoader.isSafeIntent(mPackageManager, intent, mAccount.type)).isFalse();
}
}