commit 939927a952c3c3594b2a4fd2309a25a62e62378f
author SongFerngWang <songferngwang@google.com> Wed May 05 21:35:01 2021 +0800
committer SongFerngWang <songferngwang@google.com> Thu May 06 12:05:03 2021 +0800
tree 7cc75261ecde9b8a3d4e0aa447e50c071487f20d
parent 2192a6b2d7281d020a328728dc09f9f689663a19

[security] SubscriptionGroup is exposed to unprivileged callers

SubscriptionInfo.mGroupUUID is not cleared in
conditionallyRemoveIdentifiers if the caller only has READ_PHONE_STATE
(based on a check to checkReadPhoneState) and not READ_DEVICE_IDENTIFIERS.
Bug: 181053462
Test: atest SubscriptionManagerTest

Change-Id: Ic371faf1ded5186fd6aad022ffd3bf06066e663a
Merged-In: Ic371faf1ded5186fd6aad022ffd3bf06066e663a

tests/tests/telephony/current/src/android/telephony/cts/SubscriptionManagerTest.java

diff --git a/tests/tests/telephony/current/src/android/telephony/cts/SubscriptionManagerTest.java b/tests/tests/telephony/current/src/android/telephony/cts/SubscriptionManagerTest.java
old mode 100644
new mode 100755
index 6803431..e49b8db
--- a/tests/tests/telephony/current/src/android/telephony/cts/SubscriptionManagerTest.java
+++ b/tests/tests/telephony/current/src/android/telephony/cts/SubscriptionManagerTest.java
@@ -419,6 +419,12 @@
         List<SubscriptionInfo> infoList = mSm.getSubscriptionsInGroup(uuid);
         assertNotNull(infoList);
         assertEquals(1, infoList.size());
+        assertNull(infoList.get(0).getGroupUuid());
+
+        infoList = ShellIdentityUtils.invokeMethodWithShellPermissions(mSm,
+                (sm) -> sm.getSubscriptionsInGroup(uuid));
+        assertNotNull(infoList);
+        assertEquals(1, infoList.size());
         assertEquals(uuid, infoList.get(0).getGroupUuid());
 
         List<SubscriptionInfo> availableInfoList = mSm.getAvailableSubscriptionInfoList();