hostsidetests/securitybulletin/test-apps/CVE-2021-0953/src/android/security/cts/CVE_2021_0953/DeviceTest.java

/*
 * Copyright (C) 2021 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package android.security.cts.CVE_2021_0953;

import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
import static org.junit.Assert.assertNotEquals;
import static org.junit.Assume.assumeNoException;
import static org.junit.Assume.assumeTrue;

import android.app.Activity;
import android.content.Context;
import android.content.Intent;
import android.os.Bundle;
import android.os.RemoteCallback;

import androidx.test.runner.AndroidJUnit4;

import org.junit.Test;
import org.junit.runner.RunWith;

import java.util.concurrent.CompletableFuture;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.TimeoutException;

@RunWith(AndroidJUnit4.class)
public class DeviceTest {
    public static final int TIMEOUT_SEC = 20;
    public static final String TEST_PACKAGE = "android.security.cts.CVE_2021_0953";

    @Test
    public void testMutablePendingIntent() {
        final Context context = getApplicationContext();
        PocStatus status = new PocStatus();
        CompletableFuture<PocStatus> callbackReturn = new CompletableFuture<>();
        RemoteCallback cb = new RemoteCallback((Bundle result) -> {
            PocStatus pocStatus = new PocStatus();
            pocStatus.setErrorMessage(
                    result.getString(context.getResources().getString(R.string.message_key)));
            pocStatus.setStatusCode(
                    result.getInt(context.getResources().getString(R.string.status_key)));
            callbackReturn.complete(pocStatus);
        });
        launchActivity(PocActivity.class, cb); // start activity with callback
        try {
            // blocking while the remotecallback is unset
            status = callbackReturn.get(TIMEOUT_SEC, TimeUnit.SECONDS);
        } catch (InterruptedException | ExecutionException | TimeoutException e) {
            assumeNoException(e);
        }
        assumeTrue(status.getErrorMessage(), status.getStatusCode() != context.getResources()
                .getInteger(R.integer.assumption_failure));
        assertNotEquals(status.getErrorMessage(), status.getStatusCode(),
                context.getResources().getInteger(R.integer.fail));
    }

    private void launchActivity(Class<? extends Activity> clazz, RemoteCallback cb) {
        final Context context = getApplicationContext();
        final Intent intent = new Intent(Intent.ACTION_MAIN);
        intent.setClassName(TEST_PACKAGE, clazz.getName());
        intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
        intent.putExtra(context.getResources().getString(R.string.callback_key), cb);
        context.startActivity(intent);
    }

    private class PocStatus {
        private int statusCode;
        private String errorMessage;

        public void setStatusCode(int status) {
            statusCode = status;
        }

        public void setErrorMessage(String message) {
            errorMessage = message;
        }

        public int getStatusCode() {
            return statusCode;
        }

        public String getErrorMessage() {
            return errorMessage;
        }
    }
}