hostsidetests/securitybulletin/test-apps/CVE-2021-0965/src/android/security/cts/CVE_2021_0965/DeviceTest.java

/**
 * Copyright (C) 2021 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package android.security.cts.CVE_2021_0965;

import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
import static org.junit.Assert.fail;
import static org.junit.Assume.assumeNoException;

import android.app.UiAutomation;
import android.content.Intent;
import android.content.pm.PackageManager;
import android.content.pm.ResolveInfo;
import android.os.UserHandle;
import android.provider.Settings;

import androidx.test.InstrumentationRegistry;
import androidx.test.runner.AndroidJUnit4;
import androidx.test.uiautomator.UiDevice;

import org.junit.Before;
import org.junit.Test;
import org.junit.runner.RunWith;

@RunWith(AndroidJUnit4.class)
public class DeviceTest {

    @Before
    public void startMainActivityFromHomeScreen() {
        UiDevice device = UiDevice.getInstance(getInstrumentation());
        try {
            device.wakeUp();
        } catch (Exception e) {
            e.printStackTrace();
            assumeNoException(e);
        }
        device.pressHome();
    }

    private String getSettingsPkgName() {
        PackageManager mgr = getInstrumentation().getTargetContext().getPackageManager();
        UiAutomation ui = getInstrumentation().getUiAutomation();
        String name = "com.android.settings";
        try {
            ui.adoptShellPermissionIdentity(android.Manifest.permission.INTERACT_ACROSS_USERS);
            ResolveInfo info = mgr.resolveActivityAsUser(new Intent(Settings.ACTION_SETTINGS),
                    PackageManager.MATCH_SYSTEM_ONLY, UserHandle.USER_SYSTEM);
            if (info != null && info.activityInfo != null) {
                name = info.activityInfo.packageName;
            }
        } catch (Exception e) {
            e.printStackTrace();
            assumeNoException(e);
        } finally {
            ui.dropShellPermissionIdentity();
        }
        return name;
    }

    private boolean hasFeature(String feature) {
        return InstrumentationRegistry.getContext().getPackageManager().hasSystemFeature(feature);
    }

    private boolean isTV() {
        return hasFeature(PackageManager.FEATURE_LEANBACK);
    }

    @Test
    public void testPermission() {
        String pkg = getSettingsPkgName();
        String cls = "";
        if (isTV()) {
            cls = ".accessories.BluetoothPairingDialog";
        } else {
            cls = ".bluetooth.BluetoothPairingDialog";
        }

        try {
            Intent intent = new Intent(Intent.ACTION_MAIN);
            intent.setClassName(pkg, pkg + cls);
            intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
            getApplicationContext().startActivity(intent);
        } catch (Exception ex) {
            ex.printStackTrace();
            if (ex instanceof SecurityException) {
                return;
            }
            assumeNoException(ex);
        }

        /* If SecurityException is not thrown, it indicates absence of fix */
        fail("Vulnerable to b/194300867 !!");
    }
}