PawletOS/app_Settings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Prevent intent defined in AccountPreference from leaking access" into tm-qpr-dev

Browse Source
This commit is contained in:
Binyi Wu
2022-09-21 04:14:11 +00:00
committed by Android (Google) Code Review
parent 198cb56664 2c1b1aa813
commit effd45b308
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/com/android/settings/accounts/AccountTypePreferenceLoader.java
View File

@@ -19,6 +19,7 @@ package com.android.settings.accounts;
import android.accounts.Account; import android.accounts.Account;
import android.accounts.AuthenticatorDescription; import android.accounts.AuthenticatorDescription;
import android.content.ClipData;
import android.content.Context; import android.content.Context;
import android.content.Intent; import android.content.Intent;
import android.content.pm.ActivityInfo; import android.content.pm.ActivityInfo;
@@ -164,6 +165,9 @@ public class AccountTypePreferenceLoader {
* exploiting the fact that settings has system privileges. * exploiting the fact that settings has system privileges.
*/ */
if (isSafeIntent(pm, prefIntent, acccountType)) { if (isSafeIntent(pm, prefIntent, acccountType)) {
// Explicitly set an empty ClipData to ensure that we don't offer to
// promote any Uris contained inside for granting purposes
prefIntent.setClipData(ClipData.newPlainText(null, null));
mFragment.getActivity().startActivityAsUser( mFragment.getActivity().startActivityAsUser(
prefIntent, mUserHandle); prefIntent, mUserHandle);
} else { } else {